Exploitation was already underway before the patch landed

SecurityWeek's update to the PHP2Shell leak story: details of the two CVSS-9.2 flaws went public ahead of the planned coordinated disclosure, forcing PHP to warn that fixes could ship early if in-the-wild exploitation emerged. Sansec warned that mass exploitation would likely start within 15 minutes of the patch release.

The emergency patch is out now — and SecurityWeek's update says cybersecurity firms have started seeing exploitation attempts, including before the fixes landed. WatchTowr independently confirmed the flaws are real and successfully reproduced CVE-2026-109618.