php2shell: Successful attacks confirmed, many instances still unpatched

Attackers are now exploiting the "php2shell" PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Perplexity researcher Adel Karimi documented 35 shell executions on three honeypots running PHP 8.4.26 from two IP addresses, consistent with the first CVE. CISA added both bugs to its KEV catalog, with a federal deadline of October 29. Censys still lists over 4 million services reporting vulnerable version numbers, though backported distribution patches mean this overstates exposure. Wiz reports a 67% drop in exposed machines. Several of these figures could not be independently checked.