Millions of exploit attempts have been recorded against PHP servers following the disclosure of two critical vulnerabilities known collectively as PHP2Shell. The rapid escalation has prompted urgent calls for organizations to identify affected systems and apply security updates.

According to DataBreachToday, Cloudflare observed thousands of exploitation attempts before the vulnerabilities were publicly announced, with activity increasing to millions shortly afterward.

Although widespread successful exploitation had not been confirmed at the time of that reporting, the volume of activity demonstrates how quickly attackers can begin targeting newly disclosed vulnerabilities.

For security leaders, the immediate priority is determining where PHP is running, which installations may be vulnerable, and whether remediation has been completed.

What Are the PHP2Shell Vulnerabilities?

PHP2Shell refers to two vulnerabilities affecting PHP, the server-side programming language used by websites, content management systems, and business applications.

The vulnerabilities are:

• CVE-2026-109618: A memory corruption vulnerability triggered by an out-of-memory condition.
• CVE-2026-109619: A use-after-free vulnerability involving PHP’s upload progress functionality.

According to Akamai’s technical analysis, the flaws create the potential for remote code execution.

Successful exploitation could allow an attacker to execute unauthorized code on an affected server, potentially exposing sensitive information, disrupting applications, or providing access to additional systems.

Because PHP supports many widely used web applications, the potential exposure extends across industries and organizational sizes.

Why Millions of Exploit Attempts Matter

The speed of the response from potential attackers is particularly concerning.

Amazon Threat Intelligence reported observing exploitation attempts against its honeypots before the public release of patches. Additional proof-of-concept exploits appeared shortly after disclosure.

Meanwhile, VulnCheck reported extensive interest in developing working exploits, including a growing number of publicly available proof-of-concept attempts.

An exploit attempt does not necessarily indicate a successful compromise. However, the activity shows that attackers are actively investigating these vulnerabilities and looking for systems that remain exposed.

This creates a difficult timeline for security teams. Once technical details become public, organizations may have limited time to identify vulnerable assets, coordinate updates, and verify remediation before additional attack techniques emerge.

The Challenge of Finding Every Vulnerable PHP Installation

Applying a security patch may be straightforward for a known, actively maintained server. Identifying every affected PHP installation across an organization can be considerably more complicated.

PHP may support public websites, internal business applications, e-commerce platforms, and systems maintained by third-party providers.

Older applications may also depend on unsupported PHP versions, making remediation more involved than installing a routine update.

VulnCheck’s research identified substantial numbers of internet-facing hosts running outdated PHP releases. These systems present an ongoing concern because unsupported software may require application upgrades, infrastructure changes, or migration to a supported platform.

Organizations should consider three questions:

• Do we have an accurate inventory of systems running PHP?
• Can we identify which installations are affected, including those managed by third parties?
• Do we have a process for addressing vulnerable systems that cannot be updated immediately?

These questions highlight the importance of asset visibility and vulnerability prioritization.

A security team cannot remediate an exposure it does not know exists. Effective vulnerability risk management begins with understanding where vulnerabilities exist and which systems require attention.

What Organizations Should Do About PHP2Shell Now

Given the reported severity of these vulnerabilities and the volume of exploitation attempts, Carson & SAINT recommends taking immediate, coordinated action.

1. Identify Potentially Affected Systems

Review your environment for PHP installations, particularly those supporting internet-facing applications.

Include cloud infrastructure, hosted websites, business applications, and systems managed by external providers. Confirm the installed PHP versions and determine whether vendor-supplied security updates are available.

2. Prioritize Patching

Apply the appropriate fixed PHP releases or vendor-supported security updates as quickly as operationally possible.

Prioritize internet-facing production systems and applications that process sensitive information.

For systems that cannot be updated immediately, evaluate whether they can be temporarily isolated or removed from public access until remediation is possible.

3. Run Updated Vulnerability Scans

Do not wait for the next scheduled assessment.

Conduct vulnerability scans using detection content that includes checks for CVE-2026-109618 and CVE-2026-109619.

An out-of-cycle scan can help identify overlooked assets and provide additional visibility into systems that may remain vulnerable.

4. Validate Remediation

Installing an update should be followed by verification.

Confirm that affected services are running patched versions and perform follow-up scans to determine whether the vulnerabilities are still detected.

Document remediation results and investigate any systems that continue to appear vulnerable.

5. Monitor for Suspicious Activity

Review relevant server logs, application activity, and security alerts for indications of attempted exploitation or unauthorized access.

Because the vulnerabilities attracted attention before patches became available, organizations should consider whether exposed systems require additional investigation.

Where evidence suggests a possible compromise, follow established incident response procedures.

How Carson & SAINT Is Responding

Carson & SAINT has taken proactive measures to address PHP2Shell and support customers responding to these vulnerabilities.

Our security team has confirmed that:

• All Carson & SAINT hosted environments have been patched against the two reported vulnerabilities.
• No impact to customer data has been identified.
• An out-of-cycle vulnerability detection update has been released to help identify potentially affected systems.
• Security teams continue to monitor developments and validate the effectiveness of protective measures.

These actions reflect the importance of responding to critical vulnerabilities as they emerge rather than relying exclusively on routine assessment schedules.

Organizations using Carson & SAINT solutions can leverage updated vulnerability detection capabilities to assess their environments. Other organizations should confirm that their vulnerability management tools and scanning services have incorporated the relevant checks.

Our SAINT Security Suite and SAINT Risk Navigator support the broader processes of identifying vulnerabilities, understanding exposure, and prioritizing remediation.

Critical Vulnerabilities Require an Out-of-Cycle Response

PHP2Shell demonstrates how quickly a newly disclosed vulnerability can become an urgent operational concern.

The challenge extends beyond installing patches. Organizations must know which assets are affected, determine remediation priorities, coordinate changes across teams, and verify that identified exposures have been addressed.

Regular vulnerability scanning provides an important foundation, but security programs also need the flexibility to respond when critical threats emerge between scheduled assessments.

Carson & SAINT helps organizations strengthen these capabilities through vulnerability assessment, risk prioritization, and ongoing cyber risk management.

The immediate priority is clear: identify potentially vulnerable PHP systems, apply available security updates, validate remediation, and continue monitoring for signs of exploitation.

For organizations evaluating their ability to respond to emerging vulnerabilities, contact Carson & SAINT to discuss how we can help improve vulnerability visibility and risk management.