Cloudflare sees millions of PHP2Shell exploit attempts

Cloudflare tracked a fast rise in attacks after critical flaws in the PHP programming language became public. CEO Matthew Prince said attempts went from thousands to millions within hours. Government websites in Europe and Asia went offline as precautions while administrators rushed to install emergency patches released on Wednesday, October 21.

"In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," Prince wrote on X. Reuters reported that he posted it late on Wednesday. Prince also said Cloudflare had built a new kind of web application firewall to block the attacks and turned it on for free for all customers.reuters.com+2

Flaws and fixes

The two flaws, CVE-2026-109618 and CVE-2026-109619, are known together as PHP2Shell. Both are rated 9.2 out of 10 for severity and allow unauthenticated remote code execution. The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to SecurityWeek. The flaws affect nearly every PHP release back to version 5.4. PHP moved its release forward after details leaked online a day early, Notebookcheck reported. The NSA warned that attackers could use the flaws to take control of web servers, steal data or move deeper into networks.nsa.gov+2

Some attacks started before the disclosure. Amazon security chief CJ Moses said the company's decoy servers were targeted as early as October 17, while the flaws were still embargoed. He said PHP2Shell is "now being broadly exploited in the wild."cybernews.com

Websites go dark

Finland's government website was partly disabled. Oxford City Council, the City of Edinburgh Council and the UK's Office for Budget Responsibility took their sites offline, The Independent reported. Britain's National Cyber Security Centre told organizations that cannot upgrade right away to consider taking their websites down. In Japan, Mitsubishi UFJ Financial Group suspended some internet services, and the Finance Ministry paused some website content, according to Reuters. Prime Minister Sanae Takaichi urged site owners to check whether they use PHP.independent.co.uk+1

AI's role

Security firm Calif found the flaws in August while taking part in an OpenAI program that uses AI models to find and fix vulnerabilities, Cybernews reported. OpenAI called the incident "one of the most impactful security issues in recent memory" and noted that AI can help attackers as well as defenders, The Independent reported.independent.co.uk+1

Ciaran Martin, a former head of the NCSC, warned that stolen data could fuel future fraud. "All that sort of scamming and fraud and so forth gets turbocharged," he said.