Cloud-security company Wiz says it has observed attempts to exploit two recently disclosed PHP vulnerabilities, but none of the attacks captured in its telemetry completed the full chain. The findings offer a limited snapshot of activity following the October 21 disclosure of CVE-2026-109618 and CVE-2026-109619, collectively described as PHP2Shell.
Wiz stressed that the absence of a successful attack in its own monitoring does not mean exploitation is impossible. Partners have privately shown the company exploits that work against multiple targets, and Wiz says its researchers have also produced successful demonstrations. It has not seen a public proof of concept that reliably compromises an arbitrary vulnerable target from beginning to end.
The company's exposure data points to rapid remediation. Wiz recorded an approximately 67 percent drop in the daily number of distinct internet-facing machines it identified as vulnerable in the days after disclosure. The number of organizations with at least one exposed vulnerable instance fell by about 47.9 percent. Among the remaining exposed machines, the share running PHP 7.3 or earlier declined from 8.3 percent to 5.7 percent over five days.
Those figures do not reveal exactly how organizations reduced risk. Patching, upgrading, retiring systems and restricting internet access could all contribute, while changes in scan coverage can affect the totals. The measurements therefore indicate a trend rather than a complete census of vulnerable PHP installations.
Wiz analyzed two versions of an open-source exploit kit. An older chain failed in the company's honeypot when a multipart request exceeded the configured upload limit or did not create the expected memory condition. A newer chain progressed further, repeatedly exhausting PHP memory, but failed to leak the process addresses required for later stages. The observed sources never sent the final exploitation stage.
The newer method depended on successive requests reaching the same Apache worker. It tried to keep other workers occupied with incomplete connections, then manipulated PHP session handling. In Wiz's environment, deployment differences—including memory limits, extensions and PHP builds—disrupted assumptions about the heap layout. Those variations make a universal exploit difficult to construct, although they are not a substitute for remediation.
Administrators should not interpret failed probes as evidence that vulnerable hosts are safe. The private demonstrations cited by Wiz show that workable paths exist for at least some configurations. Public exploit tooling can also improve quickly after disclosure.
The practical response remains to apply supported fixes, upgrade unsupported PHP releases, remove unnecessary public exposure and monitor servers for suspicious multipart requests, memory exhaustion and unusual connection patterns. Wiz said it would continue updating its analysis as telemetry and exploit techniques evolve. The current report captures an early phase in which remediation is accelerating while attackers are still testing incomplete or environment-specific chains.
