PHP2Shell attacks exceed 74,000 blocks as fixes stay urgent
PHP2Shell attacks have generated more than 74,000 blocked exploit or probing attempts, although Wordfence says it has not confirmed a resulting compromise across the more than 5,000,000 WordPress websites it protects. The company considers the absence of confirmed cases an indication that exploitation is complex, not evidence that unpatched servers are safe.
The PHP project issued emergency updates on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP is the programming software that runs WordPress on the hosting server. Site owners should install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use a vendor package explicitly confirmed to contain both fixes. Every PHP worker, a server process that handles PHP requests, must then be restarted. Updating WordPress does not update PHP.
Wordfence had warned site owners before the fixes became available, then reviewed the vulnerability details and tested vulnerable and patched releases. Its firewall has since intercepted attempts associated with the two flaws, as well as related attacks targeting the same PHP multipart and session-upload-progress surface. Multipart requests divide submitted data into multiple sections, commonly when a browser uploads a file. PHP session upload progress is a feature that records the status of an upload in temporary session data. Wordfence says it is expanding its monitoring as the threat develops.
One large attack cluster sends POST requests containing repeated fields named t[n]. Wordfence assessed these fields as attempts to create memory pressure and influence how PHP allocates request data. Embedded strings include the system command function and the marker P2S_OK, indicating an intended remote code execution (RCE) stage, where an attacker makes the server run commands. The example request contained 136 such fields, with 134 omitted from Wordfence's published sample. Its commands attempted to display environment variables and read the first 200 bytes of .env, ../.env, ../../.env and wp-config.php, files that can hold application settings, database credentials and other secrets. The request demonstrates intent, but it does not prove that memory corruption or command execution succeeded.
Wordfence also examined 10,000 events collected from October 20 through October 22. The sample was selected around requests referencing PHP_SESSION_UPLOAD_PROGRESS, so it is not representative of all malicious traffic. It contained 3,752 apparent P2S out-of-memory or state-corruption RCE attempts intended to shape allocations, execute commands and steal configuration data. Another 1,139 events used Laravel serialized-object gadget chains, while 2,534 used other serialized-object payloads involving Monolog, Symfony, Guzzle, WordPress, ThinkPHP and other installed classes. A serialized object packages application data in a format PHP can reconstruct; a gadget chain combines existing application functions to produce an unintended action such as command execution.
The same sample included 512 related NxSP attempts to poison a temporary session file and combine it with a separate local-file-inclusion flaw, which allows an application to load an unintended local file. Another 30 events were out-of-band PHP upload canaries, test payloads designed to trigger a callback to an external service if another upload or execution technique works. Categories can overlap because the serialized-object totals describe payload characteristics. The dataset contains requests, not server responses or endpoint records, so it measures attempted exploitation rather than successful compromise.
Attribution remains important. Wordfence says the P2S and serialized-object traffic is consistent with attempts to weaponize behavior addressed by the PHP fixes. The NxSP session poisoning and upload canaries use the same multipart or upload-progress area, but require separate vulnerabilities or application behavior. They therefore cannot be treated as confirmed exploitation of CVE-2026-109618 or CVE-2026-109619.
The observed commands attempt to confirm execution with P2S_OK, NxSP followed by numbers, or SHL_OK; profile servers using id, uname -a and hostname; and steal secrets from environment variables, .env and wp-config.php. Other payloads search common content management system directories and try to place a persistent PHP command shell named wp2s.php in writable upload, plugin or theme folders. Some attempt to download and run a second-stage payload through curl, wget and a command interpreter. Others use unique hostnames at oast.pro, oast.fun and oast.online for out-of-band verification, meaning confirmation arrives through a separate network connection.
Indicators defenders can search for include P2S_OK, NxSP[0-9]+, SHL_OK, ADV618BOUNDARY, ----P2SB, wp2s.php, php2shell.php and axiom_*.php. Object names found in payloads include Illuminate\Broadcasting\PendingBroadcast, Monolog\Handler\BufferHandler and Requests_Utility_FilteredIterator.
The 20 most active source addresses and blocked-attempt counts were 87.121.84.174 (8,525), 181.215.186.252 (7,856), 185.196.220.132 (7,146), 185.161.210.29 (5,796), 152.233.51.69 (5,317), 45.134.225.16 (3,623), 107.189.14.87 (2,365), 193.47.62.24 (2,263), 2409:40d2:204e:4be:2a1f:f9c9:a055:e00b (1,953), 103.147.220.17 (1,860), 143.246.223.124 (1,791), 52.74.54.75 (1,260), 65.49.200.56 (836), 193.142.147.111 (775), 85.137.56.188 (672), 85.137.53.26 (664), 167.254.242.130 (648), 217.112.152.168 (619), 203.78.119.133 (616) and 140.245.32.169 (616).
Successful exploitation remains dependent on PHP configuration, the Server Application Programming Interface (SAPI), which connects PHP to the web server, loaded extensions, available application classes and the condition of individual workers. In a specially configured PHP 8.5.11 Apache laboratory, Wordfence confirmed code execution while testing CVE-2026-109619. The same proof of concept crashed a normally optimized PHP 8.5.11 build instead, while PHP 8.5.12 remained healthy. For CVE-2026-109618, it reproduced different behavior between vulnerable and fixed releases but did not independently obtain code execution.
Confirming a real compromise would require evidence from responses, files, running processes, worker crashes, Domain Name System (DNS) lookups or outbound web connections on the targeted server. Some of that activity may occur outside WordPress and its logs, which limits what WordPress-level monitoring can establish. Wordfence asks anyone with relevant artifacts to send them to [email protected]; its Care and Response customers can contact its incident-response team, and Wordfence Response advertises 24/7/365 availability with a one-hour response time.
For site owners who prefer a managed environment, AEU Hosting provides managed WordPress hosting secured end to end.