TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Wiz says its telemetry recorded an approximately 67% drop in distinct internet-exposed machines vulnerable to PHP2Shell in the days after public disclosure on October 21, 2026. Its honeypots saw exploit attempts, but the captured attempts did not complete their chains; the company says the trend is consistent with remediation, while warning that its data cannot identify which fixes drove the decline.
Wiz Research says its telemetry showed an approximately 67% decline in distinct internet-exposed machines vulnerable to PHP2Shell in the days after the vulnerabilities were publicly disclosed on October 21, 2026. The company also recorded attempts to use exploit code, but said the activity it captured did not complete the exploit chains, leaving the scale of successful exploitation in other environments unknown.
Wiz’s figures describe changes in the population it observed, not a verified count of all vulnerable systems online. Over five days, the share of observed vulnerable internet-facing machines running PHP 7.3 or earlier fell from 8.3% to 5.7%. The company also reported that organizations with at least one exposed, vulnerable instance declined by approximately 47.9%. Wiz defines an affected organization for this measure as one with at least one such instance.
About one week after disclosure, Wiz said less than 53% of initially affected organizations remained vulnerable in its data. The company said the pattern is consistent with a mix of patching, upgrading, retiring machines, or restricting internet access. Its telemetry does not establish how much each action contributed, and changes in scan coverage or the observed population may also affect the results.
In honeypot activity, Wiz identified two variants of an open-source exploit kit. The older variant failed to progress in captured attempts: one request exceeded the configured 8 MB PHP post-size limit, while another sequence did not trigger the intended memory-exhaustion condition. The newer variant repeatedly exhausted PHP memory, but its next stage failed to obtain the memory addresses it needed. Wiz also observed tools using the PHP2Shell name that it said relied instead on session poisoning and a separate local file inclusion flaw.
Exposure Drops, but Risk Remains
The reported decline suggests that some organizations are responding to the disclosure by reducing exposure, but it does not show that the underlying risk has passed. Wiz says PHP is used by 65% of organizations in its dataset, making the affected software widely present in the environments it tracks. Internet-facing vulnerable instances can remain a concern even as aggregate counts fall, particularly where older PHP versions are involved.
The honeypot findings also show why exploit attempts and successful compromise should not be treated as the same measure. The newer kit reached a memory-exhaustion stage, but Wiz did not observe it completing the subsequent memory-leak step. That is evidence about the attempts captured by the company, not proof that exploitation has not succeeded elsewhere. Security teams should treat the observed attempts as a reason to check and remediate affected systems, rather than as confirmation of either widespread compromise or harmless activity.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Disclosure and Honeypot Findings
Wiz’s report follows its earlier publication on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The company says the vulnerabilities were publicly disclosed on October 21, 2026, and that it has since monitored telemetry, reviewed public exploit code, and analyzed activity in its honeypots. The figures in the update are an early snapshot, and Wiz says it will revise its findings as evidence develops.
The newer exploit-kit chain tries to make successive requests reach the same Apache child process by occupying other workers with stalled connections. Its first exploit stage uses a multipart request designed to exhaust memory during session handling. In Wiz’s captures, those requests returned HTTP 500 errors alongside PHP memory-limit failures. The later stage intended to leak process memory did not succeed in the captured runs. Wiz also said partners had privately shared exploits that work against a variety of targets, and that its researchers were continuing internal tests; it did not provide details establishing the prevalence of successful exploitation.
““We have so far observed a limited number of exploitation attempts in our telemetry.””
— Wiz Research
What the Telemetry Cannot Show
Wiz’s report does not establish how many systems have been compromised, whether successful exploitation has occurred outside its telemetry, or how representative its honeypot traffic is of attacks against real organizations. It reports that the captured chains did not complete, while also saying partners privately disclosed working exploits for a variety of targets. The company has not provided enough detail in this update to quantify those private findings or determine their prevalence.
The exposure reductions also cannot be assigned to specific remediation measures. Wiz says patching, upgrades, machine retirement, and access restrictions may all have contributed, but its data does not identify the relative effect of each. The figures can also shift with scanning coverage and the size or composition of the observed population. It remains unclear how quickly the trend will continue or whether new exploit variants will change the level of observed activity.
Monitoring and Remediation Continue
Wiz says it will continue monitoring exploitation attempts and updating its report as new evidence emerges. Organizations should check whether their PHP deployments are affected, apply available vendor fixes or upgrades, and review whether exposed systems still need to be internet-accessible. The report does not specify a date for a further update or provide a complete remediation guide, so operators should consult the relevant vendor advisories for system-specific instructions.
For readers tracking the threat, the next useful indicators will be whether Wiz or other researchers document completed exploitation in real-world environments, whether honeypot activity changes, and whether exposure counts continue to fall. Until those details are available, the report supports a cautious conclusion: observed vulnerable exposure has declined, while exploit attempts and uncertainty about activity beyond Wiz’s visibility remain.
Key Questions
What did Wiz report about PHP2Shell exposure?
Wiz said its telemetry recorded an approximately 67% drop in distinct internet-exposed vulnerable machines over the days after public disclosure. It also reported a roughly 47.9% decline in organizations with at least one exposed, vulnerable instance.
Did Wiz observe successful exploitation?
Wiz said the exploit attempts it captured did not complete their chains. It also reported that partners privately disclosed exploits that worked against a variety of targets, but the update does not quantify successful exploitation or show how common it is.
Why did some captured exploit attempts fail?
One older attempt exceeded a configured PHP request-size limit, and another did not trigger the intended memory-exhaustion condition. The newer chain did exhaust memory, but its next stage failed to obtain the memory addresses needed to continue, according to Wiz.
Does the decline prove that most vulnerable systems are fixed?
No. The figures reflect Wiz’s observed population and do not identify whether systems were patched, upgraded, retired, or taken off the internet. Wiz also cautioned that scan coverage and changes in the observed population can affect the counts.
What should PHP operators do now?
Operators should check vendor guidance for their deployments, apply available fixes or upgrades, and review internet exposure. Wiz’s update does not provide a system-by-system remediation procedure.
Source: wiz.io
