The adversary economy: How threat actors are reacting to PHP2Shell

Tenable reports that two critical, unauthenticated PHP remote code execution vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, were exploited in attempted attacks before public disclosure. Patches are available for supported PHP 8.x branches, and the vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalog. The disclosure also prompted criminal forums, including BreachForums, to migrate infrastructure because compromised PHP systems could expose member identities, communications, and stolen credentials.