PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.

On October 17, Amazon's honeypot network logged a PHP2Shell exploitation attempt from an anonymized IP address. Yet, public disclosure was still four days away. By the time PHP got its fixes in on October 21, the technical details had already leaked, proof-of-concept exploits were in wide circulation, and more exploit attempts were being logged left and right. The issue was that there were two critical, unauthenticated remote code execution vulnerabilities in the PHP engine itself (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) -- what we now know as PHP2Shell. Our own Security Research team covered what happened and what you should do: which releases to move to, which mitigations you could put in place to reduce exposure until you were able to update, and where each part of the Snyk platform sees the problem. This post now picks up where our Security Research team left off. We want to talk about what the response taught us: where this kind of exposure lives and comes from, why answering fast depends on the work we’d done months earlier, and why the next one is already on its way. Why was PHP2Shell a problem for teams with clean code? Well, because the vulnerabilities…