When we last wrote about PHP2Shell, the headline was simple: patch or pull your website. Since then the story has become more tangled.
CISA has now confirmed that attackers are using the flaws, there is a third flaw, a big attack claim has been withdrawn, and researchers say someone is quietly scanning for servers that haven't been fixed.
Here is what we know now, and what we still don't.
What hasn't changed
The two original flaws, CVE-2026-109618 and CVE-2026-109619, were fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The NCSC's advice still stands: all PHP versions may be affected, so look for PHP everywhere, start with internet-facing systems, update to a fixed version, and consider taking a system offline if you can't update or apply the temporary mitigations. Cloudflare says exploit attempts are still running into the millions.
What's new
CISA confirms attacks are under way
On Monday 26 October the US cyber agency CISA added both original flaws to its Known Exploited Vulnerabilities catalogue, which means it has evidence of attacks. US federal agencies have until 29 October to patch.
That deadline doesn't apply to UK firms, but CISA urges every organisation to prioritise these fixes. A week earlier, CISA had said it hadn't yet seen successful exploitation.
The evidence so far: a Perplexity researcher recorded 35 successful command executions across three test servers (honeypots) running PHP 8.4.26, from two IP addresses. It matched the first flaw only, no malware was downloaded, and he cautioned that the setup was favourable to attackers, so real-world results may differ.
Separately, a Delft University threat lab tracked more than 50,000 exploit requests from over 600 IP addresses in 70 countries, and 171 of those addresses sent exploit code or malware droppers. Amazon says attempts began on 17 October, four days before the patches.
Not every report has held up. Sophos has reclassified its own activity as scanning and failed attempts, and several firms tagged the pre-disclosure attempts as unsuccessful. CISA hasn't named any compromised organisation.
A third flaw, with no emergency fix
On 23 October PHP published an advisory for a third remote code execution flaw, CVE-2026-115560. It only affects applications set up in an unusual way: the session handler is switched to php at runtime before a session starts, and session upload progress is still enabled. PHP isn't issuing an emergency release.
The fix will come in the next routine release, and until then PHP recommends setting session.upload_progress.enabled=0, the same setting it suggested on 21 October. If your provider already did that, nothing more is needed.
The PHP Foundation says it doesn't expect this setup to be common, and no exploitation of this flaw has been reported.
A major attack claim was withdrawn
On 23 October, Palo Alto Networks' Unit 42 linked an intrusion at a European government body to PHP2Shell. On Sunday it retracted that, saying: "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs."
Researchers have now recorded some successful attacks (see above), but no victim has been named and CISA hasn't said how many real-world systems were breached. Anything you read claiming a confirmed government compromise tied to these flaws is still worth treating with care.
A suspected scanning campaign
Threat intelligence firm CYFIRMA says it has been monitoring a private channel since 22 October where operators reported 216 hosts as unpatched or partially mitigated, checked from 21 compromised machines.
CYFIRMA assesses with moderate confidence a link to the Lazarus family, but accepts that a Korean-speaking criminal group without state backing would fit the same facts.
It has not named victims or confirmed large-scale compromise. It also warns that some public proof-of-concept exploits are fake and may contain malware, so nobody should test them on a live system.
What this means for UK small businesses
The practical message is steadier than the headlines, but the urgency is real. The fix for the two serious flaws exists, active exploitation is now confirmed, the third flaw is narrow, and the biggest claim has been withdrawn.
But the scanning is real, and it looks for exactly the things small firms miss: an old website, a server nobody updated, or a device with a web admin page. Bitsight's advice is that PHP must be updated on the host itself. A web application firewall or a plugin update won't remove the flaw.
One group worth a second look is anyone with a network storage (NAS) box. According to The Next Web, Synology has shipped updated PHP packages, QNAP is still working on fixes with no date given, and TerraMaster says it is working towards one.
What to do this week
Get the PHP version confirmed in writing. Ask your host, agency or IT provider to confirm every site is on a fixed version or a vendor-patched build, and that the update is installed, not scheduled.
Ask about the session setting. One short question covers the third flaw: has session.upload_progress.enabled been set to 0 until the next routine release?
Check your devices, not just your websites. List any NAS boxes, routers or appliances with a web admin page, check the maker's advice, and don't expose them to the internet unless you have to.
Look for signs of a break-in. ReliaQuest suggests watching for a POST request that returns a 500 error, followed by memory errors and a crashing Apache worker. Ask your provider to check logs, and for unfamiliar files, admin users and scheduled tasks.
Stay away from random exploit code. Some public proof-of-concept exploits are fake. If you want to know whether a host is exposed, ask your provider rather than running something downloaded.
Sophia Says
It's tempting to follow every twist in a story like this. My advice is to separate what's confirmed from what's alleged. The fixes are confirmed. Millions of attempts are confirmed, and CISA now lists the flaws as exploited. A government breach tied to them is not confirmed, because the firm that reported it has withdrawn the claim. Good decisions come from the first list, not the headlines.
What HackRisk can do is take the guesswork out of "are we exposed?" We look at your business from the outside, the way a scanner would, so you can see which sites and services are visible and where known weaknesses remain. Then you know who to call.
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Forgotten sites and devices: the Recon Scan maps what your business exposes to the internet.
Known weaknesses: the Vulnerability Scan checks your internet-facing systems for known vulnerabilities, so you can see where updates are still needed.
The people who run your site: our Supply Chain Risk service helps you keep an eye on the hosts, agencies and suppliers behind your systems.
Get your free HackRisk report
Want to see what your business looks like from the outside? Get your free HackRisk report.
Sources
The Register: CISA confirms PHP2Shell under attack (27 October); BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited (27 October); The Next Web: third PHP flaw, no emergency fix; The Hacker News: PHP warns of another unpatched flaw; Security Affairs: suspected scanning campaign; NCSC: critical security issue affecting PHP.
