A week after the PHP2Shell patches, Hunt.io went through its open-directory captures and counted 616 files of exploit kits, cloned PoCs, scanners and post-exploitation tooling for CVE-2026-109618 and CVE-2026-109619. Confirmed shells so far landed on honeypots and sensors; on the open web the heap chain mostly dies in memory exhaustion. One operator aimed it at a national government in Eastern Europe, got a crash, and went in through a different bug instead.
Palo Alto’s PAN-OS is the exception: its management interface runs the same PHP 8.0.30 build on every unpatched box, which turns a flaky heap exploit into a calibrated, repeatable one. Hunt.io found a PAN-OS adaptation of the chain in an exposed directory of the operator behind the 24 rooted firewalls from the earlier post, next to the AI tooling that whittled 19,000 firewalls down to 240 targets. The exploit itself is hand-calibrated work; nothing in the capture shows a model writing it. Turns out a software monoculture is an exploit developer’s best friend.
Four other hosts share a byte-identical ASLR-bypass kit whose lab logs end in uid=33(www-data) against PHP 8.2.34 and 8.4.26.
Fixed are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and PAN-OS management interfaces belong off the internet.