GreyNoise is monitoring exploitation attempts against PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, colloquially known as 'php2shell'. View the live activity report >

This article is a summary of the full, in-depth version on the GreyNoise Labs blog.
Read the full report
GreyNoise Labs logo
Link to GreyNoise Twitter account
Link to GreyNoise Twitter account