PHP2Shell attacks under way as Cloudflare counts millions of attempts

Attackers are already targeting the critical security flaws in the PHP programming language on a massive scale. Cloudflare CEO Matthew Prince said on X late Wednesday that the network services company had seen millions of exploitation attempts against its customers, Reuters reported. According to Prince, the number rose from a few thousand in the 10 hours before disclosure to tens of thousands within 45 minutes afterwards and hundreds of thousands after two hours. Amazon security chief CJ Moses wrote in a company blog post that "PHP2Shell is now being broadly exploited in the wild," though it remained unclear whether the attempts would have succeeded against real systems.

The timing is striking: an Amazon honeypot recorded an attack attempt on Oct. 17, four days before public disclosure, routed through a commercial anonymization network. Amazon said it was unclear where the attacker obtained the information. According to the security news site The Hacker News, details and a proof-of-concept exploit leaked early, prompting PHP developers to release their fixes on Wednesday, a day earlier than planned. The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 and allow attackers to run code on web servers without logging in.

According to security firm Tenable, versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are fixed; older branches receive only minimal backports or no fix at all. VulnCheck counted about 2.6 million internet-facing servers running PHP, more than 700,000 of them on outdated versions up to 7.3. Making matters worse, the attacks leave almost no trace. "There is no authentication to bypass, no session to steal, and no vulnerable endpoint to discover," CrowdStrike said. Amazon advised patching within hours rather than days and checking servers for suspicious activity going back to Oct. 17.