PHP2Shell, Day 5: The Panic Hasn’t Turned Into Patching

Publisher preview

On October 21, the PHP project shipped emergency releases for PHP2Shell, a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) that give an unauthenticated attacker remote code execution inside the PHP engine itself. Security agencies issued urgent advisories, and some organizations pulled systems offline while they worked out their exposure. In our first report, we found that 99.3% of the PHP instances we could measure were still unpatched after 24 hours. We kept watching. As of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed. That’s roughly 15 out of every 16 hosts we can measure. Approximately 1.33 million affected hosts run end-of-life PHP branches that no longer receive official fixes. For these systems, remediation may require a version update as well. OX Security ran repeated Shodan queries from the first evening after disclosure through October 26, 2026. We classified each host by the PHP version it advertises publicly.

A saved ApplyDjinn digest is not available for this story yet.

This preview is supplied by the publisher. The complete publication remains at its original source.