CERT24PHP2Shell exploitation and scanning attempts continueLoading data…
CERT24Threat Observatory
Period

PHP2Shell exploitation and scanning attempts continue

Palo Alto Networks Unit 42 retracted its earlier assessment that activity targeting a European government agency was associated with the specific PHP2Shell CVEs. Separately, activity following abuse of CVE-2026-109618 and CVE-2026-109619 has been observed, while CYFIRMA reported coordinated, low-volume global scanning from 21 compromised nodes.

← Back to intelligence

PHP2Shell exploitation and scanning attempts continue

Palo Alto Networks Unit 42 retracted its earlier assessment that activity targeting a European government agency was associated with the specific PHP2Shell CVEs. Separately, activity following abuse of CVE-2026-109618 and CVE-2026-109619 has been observed, while CYFIRMA reported coordinated, low-volume global scanning from 21 compromised nodes.