Cloudflare and AWS report millions of exploit attempts targeting PHP2Shell vulnerabilities
Threat actors launched millions of attacks leveraging the PHP2Shell vulnerabilities, with major infrastructure providers reporting exploitation activity that began days before public disclosure and patch releases.
Cybersecurity and infrastructure providers are grappling with broad internet-wide attacks targeting newly disclosed vulnerabilities in the PHP programming language dubbed PHP2Shell. Cloudflare CEO Matthew Prince reported that the company's network logged thousands of exploit attempts during the 10 hours prior to the flaw's public announcement. Attack activity escalated quickly after disclosure, jumping to tens of thousands within 45 minutes, hundreds of thousands within two hours, and ultimately reaching millions of attempts.[3][4][8][15]
The threat activity began well before public warnings were issued. According to reporting by Wired, Amazon Web Services analysts identified at least one threat actor attempting to exploit the PHP2Shell bugs as early as October 17, four days prior to public disclosure and patching. Security researchers and news outlets confirmed that hackers had a multi-day head start before software fixes were made available.[1][5][10][11][13][16]
Cloudflare also published video showing the incoming wave of attack traffic as governments and private companies rushed to apply patches. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, present a severe server-side remote code execution risk, prompting security advisories urging website administrators to apply available updates immediately or take unprotected systems offline.[7][9][12][17]
Key facts
- AWS analysts found at least one threat actor attempting to exploit PHP2Shell flaws on October 17, four days before public disclosure and patches were released.
- Cloudflare observed thousands of exploit attempts across its network in the 10 hours before public disclosure.
- Exploit attempts on Cloudflare increased to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and later reached millions.
- Cloudflare published video showing attack traffic targeting the vulnerabilities.
- The PHP vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are jointly referred to as PHP2Shell.
- Companies and government agencies are rushing to patch the critical flaws or take affected systems offline.
Sources · 14 sources
- SE
SecurityWeek@SecurityWeekPost on X ·
PHP2Shell Exploitation Started Days Before Patches https://t.co/UZi64GbGFu
Open source - PY
PYMNTS@pymntsPost on X ·
🔓 Cloudflare logged thousands of exploit attempts before the PHP vulnerabilities went public, tens of thousands within 45 minutes of disclosure and millions after that. Full story on PYMNTS. https://t.co/yFCUhzTPGh
Open source - CT
Coin TelegraphArticle ·
PHP flaw draws millions of exploit attempts, Cloudflare CEO warns Cloudflare’s Matthew Prince said the network saw thousands of exploit attempts even before the PHP vulnerability was publicly disclosed.
Open source - TE
TechmemeArticle ·
Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward (Matthew Prince/@eastdakota) Matthew Prince / @eastdakota : Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward — Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Open source - TE
Techmeme@TechmemePost on X ·
AWS analysts claim that at least one actor started to exploit the PHP2Shell bugs on October 17, four days prior to the vulnerabilities' public disclosure (@lilyhnewman / Wired) (Visit Techmeme dot com for the link and full context!)
Open source - TE
Techmeme@TechmemePost on X ·
Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward (@eastdakota) (Visit Techmeme dot com for the link and full context!)
Open source - AG
AGTP@AGTPinsightsPost on X ·
BREAKING: Cloudflare reports millions of exploit attempts following a PHP vulnerability disclosure, and it has published video of the attack traffic. https://t.co/U67h5moOtm
Open source - RE
Reuters@ReutersPost on X ·
Cloud services firm Cloudflare saw millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X https://t.co/BPxIwcpn2Z
Open source - TS
The Straits Times@straits_timesPost on X ·
Millions of hacking attempts as companies, governments rush to patch critical PHP flaws https://t.co/RZZfJ0zomp
Open source - TE
TechmemeArticle ·
AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching (Lily Hay Newman/Wired) Lily Hay Newman / Wired : AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching — Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet.
Open source - WI
WIRED@WIREDPost on X ·
Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They're now being “broadly exploited” across the internet. https://t.co/JO03ygnfb6
Open source - NE
NeowinFeed@NeowinFeedPost on X ·
Following patches for critical PHP remote code execution vulnerabilities, Cloudflare recorded millions of exploit attempts within hours. Update immediately or take affected sites offline. #PHP #Cloudflare #Security https://t.co/orgoSYQZ22
Open source - AT
Ars Technica@arstechnicaPost on X ·
Hackers got a four-day head start on epic PHP2Shell vulnerability https://t.co/HK9DK2Nv5M
Open source - TS
The Straits Times@straits_timesPost on X ·
Millions of hacking attempts as companies, governments rush to patch PHP flaws https://t.co/RZZfJ0zomp
Open source - CO
CoinMarketCap@CoinMarketCapPost on X ·
LATEST: 🚨 Cloudflare CEO Matthew Prince says there have been millions of exploit attempts targeting the critical PHP flaw since the bug was publicly disclosed. https://t.co/gGyZvLFM0z
Open source - BL
Bloomberg@businessPost on X ·
Hackers attempted to exploit security vulnerabilities in PHP several days before the flaws became public, according to cybersecurity researchers https://t.co/fVC5UZElgA
Open source - MA
Maran@TheMaranPost on X ·
how to protect yourself from the php bug php runs ~70% of websites. two critical bugs are already being exploited. the risk is sites that haven't updated yet > how to check a site before you connect: - install wappalyzer (free browser extension) - open the site, click the icon - php or wordpress showing = don't connect till they confirm they patched - check the project's own x account for a "patched" post > not sure? ask them: copy paste this to the project: hi, have you updated php to fix CVE-2026-109618 and CVE-2026-109619 (php2shell)? i want to confirm before i connect my wallet or interact with your site, thanks > protect yourself: - update your phone, laptop, and browser - turn on two factor authentication for your email and bank accounts - avoid logging into important sites on public wifi this week > how to stay safe online - stick to official apps for banking and important services when you can - type website addresses yourself or use bookmarks. don't click random links - if a site looks broken or "under maintenance" in a weird way, don't enter any passwords > things you need to know: - the fix is out. site owners have to install it, you can't do it for them - the bug is on servers. it doesn't touch your seed phrase or the money (if you don't do anything) > what not to do - don't click any "urgent php update" or "verify your account" links. expect a lot like this - don't trust random emails or texts claiming your account is at risk because of php - don't reuse the same password everywhere. change it on anything important if you do no panic. update your devices. ignore sketchy links. then wait bookmark this. send it to the one friend who clicks everything
Open source