Global – October 31, 2026 -- CrowdStrike Counter Adversary Operations has observed no successful exploitation of the PHP2Shell vulnerabilities in the wild or in its honeypot environments, only testing, probing and unsuccessful attempts.

Global – October 27, 2026 -- PHP will ship an emergency patch for two critical core vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21, 2026, at 14:00 UTC (10:00 ET). The PHP security team rates both flaws CVSS v4.0 9.2, and researchers describe them as unauthenticated remote code execution.

Global – October 27, 2026 -- Roughly 2,000,000 internet-facing PHP servers run versions affected by two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, and 99.99% of identifiable servers remain unpatched, according to Shodan data cited by OX Security.

The PHP core team issued an out-of-band security release fixing both flaws in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Shodan counts only servers that expose their PHP version, so the real total is likely higher.

Global – October 27, 2026 -- Five days after the PHP project shipped emergency fixes for the PHP2Shell flaws, 93.6% of measurable PHP instances remain exposed, according to OX Security scans run through October 26, 2026. That is roughly 15 of every 16 hosts the firm can measure.

Global – October 27, 2026 -- Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a CVSS score of 9.2 and let unauthenticated attackers run code on web servers. Cyber insurer Coalition says its honeypots recorded exploit-related requests more than five hours before PHP released its fix, and it expects exploitation at scale.