GreyNoise is monitoring exploitation attempts against #php2shell (CVE-2026-109618 and CVE-2026-109619).
On 28 Oct 2026, 05:14:01 UTC we observed the first successful exploitation of php2shell against a vulnerable GreyNoise sensor.
"We’re seeing successful exploitation of these CVEs, but the conditions make it difficult for a threat actor to scale. Fifty different servers in various configurations can be vulnerable to these CVEs, but the same exploit may not work universally against all of them. Actors need to tailor their exploit for each respective configuration which makes mass exploitation challenging."
- Andrew Thompson, SVP of Adversary Operations at GreyNoise
This live activity report is derived from GreyNoise data and updates as we observe new activity: https://php.events.greynoise.io/
