PHP2Shell Vulnerabilities Trigger Global Cybersecurity Response as Exploitation Attempts Spread

Two critical vulnerabilities in the PHP programming language have triggered an international cybersecurity response, with security researchers reporting widespread attempts to exploit vulnerable servers. The incident highlights a crucial challenge for digital forensics: determining whether an attack attempt actually resulted in system compromise.

Reported on 24 October 2026, the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, affect the PHP runtime used to run websites and web applications. Security vendors have warned that the flaws could enable remote code execution, potentially allowing attackers to run unauthorised commands on vulnerable systems.

Palo Alto Networks' Unit 42 reported activity involving exploitation attempts and subsequent efforts to obtain password hashes and multi-factor authentication secrets in an attack against a European government entity. Investigators also observed attempts to establish a tunnel into Active Directory and escalate privileges. Separately, security vendor telemetry identified more than 22.6 million potentially vulnerable internet-exposed instances. This figure represents potential exposure, not confirmed compromises.

Forensic investigators must distinguish three stages: an exploit request reaching a server, successful execution of malicious code, and subsequent activity such as credential theft or lateral movement. A suspicious HTTP request alone does not prove that code executed successfully.

Investigators would correlate web-server and application logs with process-creation records, endpoint telemetry, authentication events and outbound network connections. Unexpected PHP files, unfamiliar child processes, unusual access to credential stores and suspicious Active Directory activity may help establish what happened after an initial exploit attempt.

Time is critical. Applying a security update can close the vulnerability, but it cannot establish whether attackers accessed the server beforehand. Organisations should preserve relevant logs and system snapshots, document patching and containment times, and investigate exposed systems for signs of execution or unauthorised access.

The public reporting does not establish that every vulnerable instance was successfully exploited, nor that all observed attempts led to data theft. Findings must be assessed system by system, using available evidence.

The forensic lesson is clear: vulnerability detection identifies risk; digital forensics establishes what actually happened. In incidents involving widely deployed software, that distinction determines whether organisations can confidently assess the scope and impact of a potential breach.