Observatory: entries

ACTIVE INCIDENT

PHP2Shell · CVE-2026-109618

PoC validated against mod_php/apache. No confirmed compromise. 19 accepted sightings.

Days since last vulnpocalypse finding

–

Counting from 2026-10-17. The figure needs a current clock, so it is filled in when the page loads.

entries tracked: 1 sightings accepted: 19 pending review: 2 active IOCs: 14 Why this exists →

Observatory entries: headline tier, fingerprints and sightings. Updated 2026-10-25T23:17:14.028Z.
CVE	Alias	Headline tier	By fingerprint	First sighting	Last sighting	Sightings	IOCs	KEV	Action
CVE-2026-109618	PHP2Shell · GHSA-w8hw-w9fx-j79w	poc-validated	scanningphp-cgi/iispoc-validatedmod_php/apacheattemptsphp-fpm/nginxattemptsmod_php/apache	2026-10-17	2026-10-23	19	14	not listed	Open →

Community pulse · PHP2Shell 1,284 responses · anonymous · aggregates only

How hard has this been?

3.9 / 5

67% answered 4 or 5

Biggest blocker

Branch is EOL, no fix

41% · then "My host controls PHP" 27%

Where people are now

patched: 48%

still exposed 22% · mitigated 19% · offline 11% · not affected 0%

What would have helped

“A single page that said whether php-fpm was actually at risk. Took me a day to find that.”agency · php-fpm/nginx

“My host's status page said 'monitoring' for 30 hours. I needed the question to ask their support.”small-business · host-managed

Observatory entries