Obstacles to Weaponizing PHP2Shell Likely Constrain Immediate Widespread Exploitation

On October 21, 2026, PHP disclosed two critical severity vulnerabilities (now tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell) affecting multiple PHP versions. These vulnerabilities, which potentially allow an unauthenticated threat actor to achieve remote code execution (RCE) under certain conditions, are exploitable in products running vulnerable PHP versions. Due to their severity and the fact that PHP powers approximately 70% of all websites on the internet,1 including WordPress, these vulnerabilities have received widespread media and industry attention prior to and immediately after disclosure. Industry sources have disclosed proof-of-concept (POC) code related to these vulnerabilities or other alleged PHP vulnerabilities. Many of the ones CrowdStrike Counter Adversary Operations has analyzed are crash POCs that only prove a vulnerability exists; converting them to a reliable POC exploit capable of reliably achieving RCE is not trivial or guaranteed. To exploit these vulnerabilities, attackers must…