Detecting exploitation attempts against CVE-2026-109618 without a public exploit

Critical unauthenticated Remote Code Execution vulnerabilities in the PHP core, tracked as PHP2Shell under CVE-2026-109618 and CVE-2026-109619, were announced on 20 October 2026. Both carry a CVSS v4.0 rating of 9.2 and were patched in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Despite the lack of a public proof of concept, global telemetry recorded millions of automated attacks per hour, forcing healthcare, university, and government systems to temporarily take websites offline following urgent national cyber authority advisories.