Exposed to PHP2Shell? Cyber Experts Weigh in With Advice

Security researchers report that organizations are struggling to patch the PHP flaws dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) at anywhere near the pace attackers are exploiting them. Cloudflare's CEO said exploitation attempts rose from thousands before public disclosure to millions within hours, while Check Point found roughly 10% of organizations worldwide already hit. Scans by Ox Security and Flare showed that more than 97% of discoverable PHP deployments still hadn't shown updated version banners a day or more after fixes were released, and Cisco Talos estimates about half of all PHP systems may never get patched. Experts note that remediation is unusually hard because PHP runs hidden inside cameras, storage appliances and access-control systems, old version numbers can mask backported fixes, and large enterprises often rely on slow 'golden image' deployment pipelines—so immediate mitigations like disabling session.upload_progress and isolating unpatchable systems are being recommended as stopgaps.