The PHP panic has not turned to patching: And that’s bad news, capital B, as PHP2Shell attacks ramp up.We know the paired PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, aka PHP2Shell, have a Common Vulnerability Scoring System (CVSS) score of 9.2, which is scary bad. After all, about 70% of websites with an identifiable server-side language run on PHP-based systems like WordPress.But does that mean people are patching their servers as fast as they can? To quote Moshe Siman Tov Bustan of Ox security: “The panic hasn’t turned into patching.” Ox reports in a new blog post that of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed.“Wow! Ow!“…remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild”Bustan goes on to write, “Remediation is too slow, while everyone panics about PHP CVEs, remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild… we missed the opportunity to actually get our patches out the door – and now, when exploits are out there, proven in the wild and not just speculation – we’ve left our most precious assets exposed for the next hacker to take advantage of.”We really do like living dangerously, don’t we? It’s not just Ox reporting abysmal PHP2Shell patch numbers. Censys, a security company, in its PHP2Shell survey as of Tuesday, reports that about 11.2 million Internet-facing PHP services are reporting patched versions. That’s not as impressive as it sounds. These counts are based on the PHP versions servers report, and because Linux distributions often backport fixes without changing the version number, some “vulnerable” services may already be patched. Some 32.5 million are still showing they’re running unsafe PHP versions. Censys also doesn’t know what 61,303,506 PHP services (58% of all detected) are running. Many of these are likely to be running unsupported versions of PHP.That’s scary news. The security company Flare found that of the 2.2 million PHP service records it tracked in an October 22nd report, “nearly three quarters advertised a PHP branch no longer supported by the PHP project.”Another study of 2.6 million services by Mallory, a security firm that uses AI to track Internet dangers, found about 1.9 million internet-facing services running unsupported PHP versions. That’s about 73.5% of the surveyed services.Such systems get no official patch release. They must be updated to a supported version.Such systems get no official patch release. They must be updated to a supported version. That’s a much more involved job than simply patching a supported version of PHP.As Ramy Rahman, senior principal solutions engineer at ArmorCode, an AI security company, said in a statement on Tuesday, “The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes.” Be that as it may, as the National Security Agency (NSA) says when PHP2Shell first appeared, “All organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities …. If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated.“Clearly, while some organizations have done so, such as the Wikimedia Foundation and Internet Archive, and two PHP-driven online games have closed down permanently, most did not. Meanwhile, some governments have made patching mandatory. The biggest example is the US. The Cybersecurity and Infrastructure Security Agency (CISA) made PHP2Shell remediation mandatory for Federal Civilian Executive Branch agencies, with a deadline of Thursday, October 29, 2026. That’s easier said than done. As we’re seeing, PHP2Shell attacks are now ongoing. CISA hasn’t given any details, but the CVE reports are now listed in its Known Exploited Vulnerabilities catalog.In addition, Adel Karimi, a Paerplexity AI‘s detection and response lead, says his honeypots recorded evidence of confirmed remote code execution against an Apache mod_php installation running PHP 8.4.26, a vulnerable pre-patch version. Karimi cautioned that his single-worker setup was deliberately favorable to attackers. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.And, as Cloudflare CEO Matthew Prince posted on X, “In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.” It’s only getting worse. Soon this wave of attempts will become a flood of successful attacks. Fasten your seatbelts, it’s going to be a bumpy ride.The post “The panic hasn’t turned into patching”: What security researchers really think about the PHP2Shell response appeared first on The New Stack.