Reporting on the fixes, exploitation reports and unresolved questions. Each update keeps the source, event date and publication date separate.
Security Affairs, citing Censys, reported an estimated 34.4 million vulnerable PHP services; the reports reviewed do not confirm a real-world RCE. PHP also issued a separate session-upload advisory.
What the first day of PHP2Shell reporting established: the fixes are confirmed, attempts are documented, exposure estimates disagree, and no confirmed mass compromise has been publicly established.
The WAF provider deployed protections about nine hours before disclosure and then tracked a steep rise in attack traffic. It still says customers must patch.
A honeypot attempt on 17 October predates the leak and the public advisory. SecurityWeek reports that PoCs circulated hours before disclosure, but attempts are not confirmed compromises.
Researchers describe a messy exploit ecosystem: some public PoCs do not work, some crash targets, and at least one repository was a prank. That does not make the underlying flaw less serious.
The official advice is consistent: patch immediately, restart workers, and isolate if that is not possible. Some organisations chose to take services offline rather than wait.
CVE-2026-111497 is a Node.js core flaw, not PHP2Shell and not an npm package issue. It is a useful reminder to keep runtime and package inventories separate.
The Foundation says signs appeared in a 2024 audit, competing fixes stalled, and AI-assisted review plus external reports forced the issue back to the top in August 2026.
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix CVE-2026-109618 and CVE-2026-109619. The flaws sit in the runtime, so updating a CMS or plugin is not enough.