Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit’s complexity considering Wordfence secures over 5,000,000 WordPress websites.

The remediation remains unchanged: install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package explicitly confirmed to contain both fixes, and restart every PHP worker. Updating WordPress itself does not update PHP.

The Attack Data

One of the largest clearly identifiable attack clusters uses requests like the following. The multipart body contains repeated fields carrying an apparent command-execution layout and commands that attempt to read .env and wp-config.php.

POST / HTTP/1.1
Connection: close
Cookie: %5Bredacted%5D=%5Bredacted%5D;
Accept-Language: en-US,en;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Host: [redacted]
Content-Type: multipart/form-data; boundary=p2s0adf525faa
Content-Length: 63395

--p2s0adf525faa
Content-Disposition: form-data; name="PHPSESSID"

d1f6b03d7696286fe2bb0537a5
--p2s0adf525faa
Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"

x
--p2s0adf525faa
Content-Disposition: form-data; name="t[0]"

@0000000AAAAAAAA000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000AAAAAAAA00000000000000000000000000000000000000system0echo P2S_OK;env;head -c 200 .env ../.env ../../.env wp-config.php0000000000000000
--p2s0adf525faa
Content-Disposition: form-data; name="t[1]"

@0000000AAAAAAAA000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000AAAAAAAA00000000000000000000000000000000000000system0echo P2S_OK;env;head -c 200 .env ../.env ../../.env wp-config.php0000000000000000
--p2s0adf525faa
Content-Disposition: form-data; name="t[135]"
[truncated]
@0000000AAAAAAAA000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000AAAAAAAA00000000000000000000000000000000000000system0echo P2S_OK;env;head -c 200 .env ../.env ../../.env wp-config.php0000000000000000
--p2s0adf525faa
Content-Disposition: form-data; name="t[136]"

@0000000AAAAAAAA000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000AAAAAAAA00000000000000000000000000000000000000system0echo P2S_OK;env;he
--p2s0a"

This request is more than a generic upload probe. The repeated t[n] fields are consistent with an attempt to create memory pressure and shape request allocations, while the embedded system string and P2S_OK marker show an intended command-execution stage. We truncated 134 of the t[n] fields from the request. If successful, the example command would return environment variables and portions of common WordPress and application configuration files. The request alone does not prove that memory corruption or command execution occurred, however, it provides valuable insights as to what is being attempted.

Exploit Families Observed

We analyzed a 10,000-event sample collected between October 20th and October 22nd. This sample was selected around requests referencing PHP_SESSION_UPLOAD_PROGRESS, so it should not be treated as a representative sample of all potentially malicious traffic. It nevertheless shows several distinct payload families rather than a single proof of concept.

Serialized-object counts describe payload characteristics and may overlap other behavioral categories. The event sample contains requests, not response bodies or endpoint telemetry, so these figures measure attempted exploitation rather than successful compromise.

What the attackers are trying to do

• Confirm command execution using markers such as P2S_OK, NxSP and SHL_OK.
• Profile the server by running commands such as id, uname -a and hostname.
• Steal credentials and secrets from environment variables, .env and wp-config.php.
• Install persistent access by searching common CMS directories and attempting to write a PHP command shell named wp2s.php into writable upload, plugin or theme locations.
• Retrieve and execute a second-stage payload using curl, wget and a shell interpreter.
• Verify execution out of band through unique callback hostnames under services such as oast.pro, oast.fun and oast.online.

Non-IP indicators for defenders

P2S_OK
NxSP[0-9]+
SHL_OK
ADV618BOUNDARY
----P2SB
wp2s.php
php2shell.php
axiom_*.php
php-to-shell
Illuminate\Broadcasting\PendingBroadcast
Monolog\Handler\BufferHandler
Requests_Utility_FilteredIterator

Top Attacking IPs

The 20 most active source addresses below account for the largest share of blocked attempts.

Our Assessment

Exploitation remains sensitive to the PHP configuration, SAPI, loaded extensions, application classes and worker state. However, the traffic is not limited to generic or malformed probes. We are seeing purpose-built requests that combine memory-pressure techniques, serialized-object gadget chains, command-execution markers and post-exploitation actions.

The presence of these payloads does not establish that the targeted websites were successfully compromised. The request data does show clear intent to execute commands, steal configuration data, install persistent PHP access and retrieve additional payloads. Confirmation would require response, filesystem, process, worker-crash, DNS or outbound HTTP evidence from the targeted server.

These observations are consistent with our previously published testing. In a specially configured PHP 8.5.11 Apache lab, we confirmed code execution while testing CVE-2026-109619; the same proof of concept crashed a normal optimized PHP 8.5.11 build instead, while fixed PHP 8.5.12 remained healthy. For CVE-2026-109618, we reproduced the vulnerable-versus-fixed behavior but did not independently achieve code execution. The production traffic analyzed here does not change those lab results or establish a successful real-world exploit.

At this time, we have not observed any confirmed compromises resulting from these vulnerabilities. We are continuing to closely monitor the situation and will share additional details as they become available. The absence of a confirmed compromise in our telemetry is not evidence that an unpatched server is safe, particularly because some relevant failures and callbacks may occur outside the WordPress application and its logs. However, this is a sign of how complex the exploit actually is.

Wordfence Care and Wordfence Response customers can contact our incident response team if they believe a site may have been compromised. Wordfence Response provides 24/7/365 availability with a one-hour response time.

If you know someone who manages WordPress sites, please share this article and ask them to verify the PHP service behind each site.

The post Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet appeared first on Wordfence.