GreyNoise is monitoring exploitation attempts against PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, colloquially known as 'php2shell'.