Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts

What happened

Hackers Launch Mass Scanning Campaigns Using Public PHP2Shell Exploit Scripts, according to GBHackers. Hackers are sweeping internet-facing PHP infrastructure with publicly circulating PHP2Shell exploit scripts, turning the disclosure of two critical vulnerabilities into a worldwide reconnaissance campaign. Fastly recorded approximately 250,000 requests from PHP2Shell-named tools across roughly 3,200 public IP addresses through midday October 22.

However, those figures include defensive scanners and do not establish successful server compromises.

cyber security Cyber Security News 3 min.

The activity targets CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell, which carry CVSS scores of 9.2. Both vulnerabilities affect the PHP engine and can enable unauthenticated remote code execution (running programs on a machine from somewhere else) under specific conditions.

Because the weaknesses sit beneath application code, updating a content management system alone does not remediate the underlying exposure. The most widespread kit sent POST requests to /index.php or /, used the User-Agent php2shell-109618, and supplied a multipart boundary of B7kQpoc618. Requests targeted raw IP addresses rather than hostnames, typically hitting each host once or twice.