Unit 42 retracts PHP2Shell link to European agency breach
Palo Alto Networks' Unit 42 withdrew its October 23 analysis that tied an attack on a European government agency to PHP2Shell exploitation, citing unconfirmed intrusion vector.
Palo Alto Networks' threat-analysis organization Unit 42 revised its official threat report on October 25 and withdrew the analysis it had added on October 23, according to dailysecu.com. The withdrawn analysis had assessed that an attack on a European government agency in a vulnerable PHP environment was related to exploitation of the PHP2Shell vulnerabilities.
Unit 42 said it could not confirm that the initial intrusion into the European government agency happened through the PHP2Shell vulnerabilities. The company emphasized that the withdrawal concerns the intrusion vector, not the existence of the intrusion activity itself.
In the revised report, Unit 42 also stated that its threat-detection signature does not identify only the two CVEs, CVE-2026-109618 and CVE-2026-109619, and may also flag benign activity. The two PHP2Shell vulnerabilities are rated at 9.2 out of 10 by Unit 42, which continues to recommend exposure checks and prompt security updates.
Earlier observations
On October 17, Amazon Web Services began observing PHP2Shell exploit attempts against decoy systems. On October 21, KISA recommended security updates for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later.
Quick answers
What did Unit 42 withdraw on October 25?
Unit 42 withdrew its October 23 analysis that linked an attack on a European government agency to PHP2Shell exploitation, saying it could not confirm the intrusion vector.
Which PHP versions did KISA recommend updating?
KISA recommended security updates on October 21 for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later.
What severity rating did Unit 42 give the PHP2Shell vulnerabilities?
Unit 42 rates the two PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, at 9.2 out of 10.