Reporting published October 27 described evidence of successful exploitation of the PHP2Shell flaws against honeypot systems — deliberately exposed machines researchers use to detect and study attacks.

According to BleepingComputer, researchers had documented attempts targeting the flaws before public disclosure, while later tests demonstrated successful remote code execution.

That distinction matters: prior coverage focused on pre-patch attack attempts, but honeypot success shows the attacks actually work end to end on unpatched servers.

The two flaws score 9.2 out of 10 under CVSS version 4.0, allowing unauthenticated attackers to execute code on affected servers without logging in.

On October 26, the U.S. Cybersecurity and Infrastructure Security Agency added both PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities Catalog, which identifies flaws with evidence of exploitation and helps organizations prioritize fixes.

Federal civilian agencies are subject to a deadline to remediate the vulnerabilities, and CISA encourages other organizations to prioritize them as well. The move came days after PHP developers released security updates on October 21 urging administrators to patch affected systems immediately.

The escalation from catalog listing to documented honeypot compromise underscores why security teams are treating the fixes as urgent rather than routine maintenance.

Evidence that attackers have exploited a vulnerability does not establish that every vulnerable website was compromised or that customer information was stolen; determining whether data was accessed requires investigating individual systems for signs of unauthorized activity.

Honeypots are engineered bait, so their compromise proves exploitability rather than universal breach — but it also confirms that the same techniques work against any internet-facing server still running affected PHP versions.

PHP powers roughly 70% of the world's websites, so even a narrow exploitation pattern touches an enormous population of content management systems and platforms that handle sensitive customer information.

PHP administrators should identify affected installations and apply the appropriate security updates immediately, prioritizing systems accessible from the internet.

Organizations should also work with their web-hosting providers, check for PHP installations used by third-party applications, and review system logs for suspicious activity. If a system cannot be updated promptly, administrators should follow official guidance to reduce its exposure.

The PHP security team has published details of the updates and affected versions in its official advisory, and researchers used artificial intelligence to help identify and demonstrate the flaws — a capability that also arms malicious actors targeting unpatched systems.