PHP2Shell exploitation reports are now public. GreyNoise has counted at least six successful attacks on CVE-2026-109618 and CVE-2026-109619, and the security firm Dream says a Chinese threat actor used the bugs to compromise 24 firewalls. If you run PHP anywhere, including inside a security appliance, a patch closes the hole but removes nothing already planted.
