The wording implies they've seen php2shell being exploited in the wild, because they observed agentic post-exploitation activity? Also, their IOC's are not specific to these vulnerabilities. https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
Unit 42Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 23)CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web servers and CMS systems.