Wiz: No successful PHP2Shell exploits seen so far; exposure down 67%

Wiz’s investigation tracks remediation and attempted exploitation of two PHP vulnerabilities disclosed as PHP2Shell on October 21, 2026. Its telemetry shows the number of distinct vulnerable, internet-exposed machines fell about 67% in the following days, while organizations with at least one exposed vulnerable instance declined by 47.9%. The share of vulnerable machines running PHP 7.3 or earlier also dropped from 8.3% to 5.7% in five days. A week after disclosure, fewer than 53% of initially affected organizations remained vulnerable. These trends are consistent with patching, upgrades, machine retirement, or access restrictions, though the data cannot distinguish their individual effects.

Wiz observed exploit attempts but no completed PHP2Shell chain in its own telemetry. An older exploit-kit variant was blocked by request-size limits or failed to trigger the required memory exhaustion. A newer variant reliably exhausted PHP memory, but its next step - leaking memory addresses - failed in every captured run, and attackers did not proceed to code execution. The chain depends on successive requests reaching the same Apache worker and on memory layouts that vary with PHP builds, extensions, and configuration, making generic exploitation unreliable. Some PHP2Shell-labeled tools instead used session poisoning combined with a separate local-file-inclusion flaw, so they did not exploit the disclosed vulnerabilities on their own. Wiz notes that public honeypot evidence from another researcher did show successful exploitation under a favorable single-worker configuration, but does not establish reliability across deployments.