PHP2Shell: Early Attack Activity Through Imperva’s Lens
PHP2Shell CVE-2026-109618/109619 sees 482K requests targeting 22K sites in 24 hours post-disclosure.
Following public disclosure of PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), Imperva Threat Research documented a sharp spike in scanning and exploitation attempts, recording 482,342 requests across 122,311 attack sessions targeting 21,998 sites in 103 countries within the first 24 hours. The activity exhibited opportunistic spray-and-pray scanning patterns with an average of 3.9 requests per session, concentrated in the United States (64.5% of targets) and spanning multiple industries including Business, Education, and Financial Services. Imperva had participated in coordinated disclosure alongside Wiz, OpenAI, and others, enabling rapid deployment of detection rules before the October 21 embargo lift.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Imperva?
Get an email when a new story names Imperva, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- Web application firewall and DDoS protection
Websites and APIs stay up, and common web attacks are filtered before they reach them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-109618
- cve — CVE-2026-109619