CriticalBreach
Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground
ThreatMon·Source published ·1 min read
What happened?
Blog October 27, 2026 Dark Web Patched, Not Over: PHP2Shell Exploits Keep Spreading Underground PHP fixed the two PHP2Shell vulnerabilities on 21 October 2026, yet alleged exploit code kept circulating on underground forums and Telegram through 23 October. The patch has not ended attacker interest, so defenders need to confirm the fix is actually running and hunt for signs of exploitation. Key Findings Two critical PHP flaws: CVE-2026-109618 and CVE-2026-109619 both carry a CVSS v4.0 score of 9.2. Fixes ship in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.