Wiz sees no successful PHP2Shell exploits as exposed machines drop 67%
PHP2Shell: Exploitation Attempts and Remediation Trends
After disclosing two critical PHP vulnerabilities on October 21, Wiz tracked a roughly 67% drop in internet-exposed vulnerable machines and a 47.9% decline in affected organizations within days. Its honeypots captured exploitation attempts using public exploit kits, but none completed the full chain: memory-exhaustion stages fired, yet the memory-leak and final stages failed. Wiz attributes this to build-specific heap layouts, memory limits, and the difficulty of pinning requests to the same Apache worker.
Our observations show that triggering memory exhaustion alone is not enough to complete the exploit chain.