Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit’s complexity considering Wordfence secures over 5,000,000 WordPress websites.

Through our built-in firewall protections, the Wordfence Firewall has already intercepted over 74,000 exploit or probing attempts associated with the newly disclosed vulnerabilities, along with related attacks abusing the same PHP multipart and session-upload-progress surface. To better track and assess the evolving threat landscape, we are actively expanding our monitoring capabilities.