CriticalCVE
PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It.
Morphisec·Source published ·1 min read
What happened?
Every public exploit targets Linux. The attacks we blocked were on Windows IIS. For 110 million servers running end-of-life PHP, no patch exists. Here is what we saw, and how AMTD shut it down. On October 21, the PHP project shipped emergency fixes for two critical memory corruption vulnerabilities in the PHP runtime: CVE-2026-109618 and […] The post PHP2Shell Is Hitting Windows Servers in the Wild. We Stopped It. appeared first on Morphisec.
Key details
- PHP2Shell allows unauthenticated remote code execution via a single HTTP request before any application code runs.
- 110 million PHP installations on end-of-life branches will never receive an official vendor patch for PHP2Shell.
- PHP2Shell exploitation has been confirmed on Windows servers running IIS with PHP-CGI.
- Organizations should hunt for compromise activity on exposed PHP servers from August 1, 2026 onward.
Affected
- End-of-life PHP branches 8.1, 8.0, 7.x, and 5.x are affected.
- Windows servers running IIS with php-cgi.exe are affected.
Summarised by SecOraLens from Morphisec. Always read the original source before acting. How SecOraLens verifies advisories.