Security researchers and threat intelligence organizations worldwide are sounding the alarm over a wave of aggressive exploitation and reconnaissance targeting critical flaws in PHP, collectively known as the "PHP2Shell" vulnerabilities. Tracked as CVE-2026-109618 and CVE-2026-109619, these severe security gaps have sparked an unprecedented volume of internet-wide scanning and exploitation attempts, affecting millions of systems and drawing the attention of advanced persistent threat groups.
The situation escalated following initial reports from telemetry providers like Cloudflare, which detected millions of exploitation attempts immediately after the flaws were made public. These critical vulnerabilities, which affect default PHP configurations, can lead directly to remote code execution (RCE). Security analysts explain that an attacker exploiting these flaws faces specific technical constraints: they must precisely size a request to fail memory allocation at the exact right moment and overcome Address Space Layout Randomization (ASLR) to locate valid memory addresses.
According to insights published by security researchers at Datadog, the exploit relies on a specific mechanism involving form-field names. An attacker utilizes a field name that is small enough to fit within the accepted request body, yet large enough that copying its key exceeds the configured memory_limit. When PHP parses a form-field name, it makes several copies along the way. The attacker leverages this extra memory consumption to force an allocation failure while PHP copies the name into a hash table, setting the stage for code execution.
Amid this global backdrop of automated scanning and opportunistic attacks, targeted campaigns have begun to emerge. Palo Alto Networks Unit 42 initially reported on a sophisticated post-compromise activity targeting a European government agency, suggesting the use of agentic artificial intelligence platforms. In an updated assessment, a spokesperson for Palo Alto Networks clarified that while researchers observed an attack executed against a European government agency within the context of a vulnerable PHP application, the company is unable to definitively confirm that the initial access vector is directly associated with the specific PHP2Shell CVEs. Nevertheless, the post-compromise behavior highlighted how rapidly modern threat actors can pivot after breaching a network.
According to Unit 42’s initial observations of that specific incident, attackers within two hours of initial access successfully obtained password hashes and multi-factor authentication secrets. Furthermore, the threat actors established an NT LAN Manager (NTLM)-relay tunnel into Active Directory and attempted Domain Admin privilege escalation. Security analysts noted commands and behavioral markers wrapping command batches in section-header delimiters, such as ==SHELLUSER== and ==PASSWD==, which produce machine-parseable output designed for an AI model to read and interpret during autonomous operations.
Concurrently, threat intelligence firm CYFIRMA uncovered a suspected North Korea-linked campaign utilizing PHP2Shell to actively probe global PHP infrastructure using a network of 21 compromised nodes. CYFIRMA’s CEO and founder, Kumar Ritesh, described the scanning activity as deliberately low-volume and paced to evade detection. According to CYFIRMA, the threat actors rotate and abandon their scanning nodes at the first sign of blocking or rate-limiting, rendering traditional threshold-based alerting largely ineffective.
The targeted infrastructure spans 216 unpatched or partially mitigated hosts distributed across the United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, the United Arab Emirates, Saudi Arabia, and the European Union. These vulnerable hosts cover critical sectors, including government entities, financial institutions, logistics networks, aviation and airports, manufacturing facilities, and online transaction platforms. CYFIRMA warned that organizations in these prioritized sectors and geographies should operate under the assumption that they are within the direct scope of targeted operations.
Attribution analyses link this campaign with moderate confidence to the Lazarus Group ecosystem. CYFIRMA identified a closed I2P channel where Korean-speaking operators coordinated their activities, sharing target lists, exploit-hosting infrastructure, and operational tasking. Notably, the captured communications exhibited vocabulary and spelling specific to North Korean standards rather than South Korean conventions. Indicators also pointed to specific operator handles previously observed managing covert operations for North Korean state-sponsored threat actors, with indications that the group planned to shortlist promising targets and adapt public exploits for subsequent attacks.
Other security organizations have observed similar probing behavior from known mass-exploit infrastructure. Defused Cyber reported scanning activity targeting its Palo Alto Networks GlobalProtect honeypots originating from an IP address previously linked to widespread exploit attempts. These incoming requests carried a PHP_SESSION_UPLOAD_PROGRESS marker along with a dummy file upload lacking any actual payload, indicating that threat actors were actively checking for vulnerable upload-progress behavior to build comprehensive target lists of vulnerable devices.
Organizations striving to secure their environments are actively working to identify indicators of compromise. ReliaQuest successfully reproduced CVE-2026-109618 in a controlled laboratory setting, identifying a distinct sequence of artifacts across PHP error logs, Apache access logs, Apache error logs, and system logs. Defenders are advised to monitor for a specific sequence where an incoming POST request returns a 500 error, PHP subsequently reports memory exhaustion and heap corruption, and the Apache worker handling the request ultimately crashes.
Compounding these challenges, the PHP Foundation warned of an additional remote code execution vulnerability, tracked as CVE-2026-115560, which manifests under a specific combination of application code and configuration settings. Specifically, an application must configure session.serialize_handler to use php_binary or php_serialize and then dynamically switch it to php at runtime using ini_set() prior to invoking session_start(), while session upload progress must remain enabled. While expected to be addressed in upcoming regular release cycles, security firms like Xint have released dedicated scanning tools to help administrators determine whether their hosts are exposed to PHP2Shell risks, noting that RCE remains possible across various PHP scripts depending on how decoding operations are handled.
Internet-wide scans conducted by Bitsight underscore the sheer scale of the challenge, revealing that nearly 37 million internet-facing systems currently run PHP or related software globally, with heavy concentrations located in the United States, Germany, France, the Netherlands, and Japan. Because PHP forms the foundational runtime for a vast portion of the modern web—including content management systems, e-commerce platforms, and bespoke internal corporate tools—security experts emphasize that traditional mitigations such as web application firewall rules or plugin updates are insufficient. Mitigating the risk entirely requires updating the PHP runtime directly on the host infrastructure to close the vulnerability gap.
