The flaw needs an unusual setup to be exploitable: an application must set session.serialize_handler to php_binary or php_serialize in its configuration, then switch it to php at runtime with ini_set() before calling session_start(), and the session upload progress feature must be enabled. Elizabeth Barron, executive director of the PHP Foundation, said this requires "a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP."

That contrasts with the two memory-safety bugs disclosed and patched on Wednesday, CVE-2026-109618 and CVE-2026-109619, which together make up PHP2Shell. PHP runs on about 70 percent of websites with a known server-side programming language, which is why the earlier flaws drew so much attention.

Despite reports of mass exploitation attempts and multiple public proof-of-concept exploits, there have been no publicly confirmed successful compromises attributed to PHP2Shell as of Friday. Barron said the foundation has no evidence of successful exploitation before disclosure or on patched versions, and no reported issues from OpenAI, Wiz or Calif, with whom it is working closely.

Caution is still warranted. Mandiant chief technology officer Charles Carmakal said in a LinkedIn post that exploitation may have begun in a limited fashion and the threat is "viable and very serious." He noted many circulating PoCs appear to be "vibe-coded" and incapable of remote code execution, but that Mandiant has validated some that work against default mod_php deployments, though not PHP-FPM.