Skip to content
techworthit
techworthit

One question, one number. TechWorthIt reads the world's tech reviews and reporting, then tells you whether it's worth your money, with every source linked.

How we scoreAboutContactPrivacyTermsRSS
© 2026 TechWorthIt · We may earn a commission from links. It never changes a verdict.
LatestReviewsDealsSearchSaved 0
SectionNews / Dev
AuthorTechWorthIt Desk
PublishedOct 23, 2026 · 3 min

PHP2Shell flaws draw millions of exploit attempts as sites go offline to patch

Two critical PHP bugs rated 9.2 out of 10 were probed days before disclosure, according to Amazon, while researchers say successful real-world attacks remain limited.

Dev
On this page
  1. What the flaws are
  2. Exploitation began before disclosure
  3. Real-world impact so far
  4. New guidance and what to watch
0% read
On this page · 4 sections ▾
  1. What the flaws are
  2. Exploitation began before disclosure
  3. Real-world impact so far
  4. New guidance and what to watch

Attackers have launched millions of attempts to exploit two critical PHP vulnerabilities known as PHP2Shell, according to Cloudflare CEO Matthew Prince, as governments and companies took services offline to apply fixes.

Prince posted the figures on X, as reported by The Next Web. Cloudflare saw thousands of attempts in the 10 hours before public disclosure, tens of thousands within 45 minutes after it, hundreds of thousands within two hours, and millions by the time he posted.

What the flaws are

The bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 for severity. They allow code execution on a web server without logging in, and ZDNET adds that they can also expose sensitive process memory. Wiz, which found the flaws with AI help, says PHP runs on 70% of the world's websites.

PHP released emergency patches on Wednesday for versions 8.2 through 8.5, a day early after technical details leaked, per The Next Web. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions older than 8.2 no longer get official support, so those operators may need to rely on vendors or hosts.

Exploitation began before disclosure

TechRadar reports that Amazon Threat Intelligence found an exploit attempt dated Oct. 17 in its MadPot honeypot telemetry, four days before disclosure. It came from an IP address tied to a commercial anonymization network. Amazon said it is unclear how the actor learned of the flaw while it was under embargo.

TechRadar also says Chainguard allegedly published container images containing the fixes a few hours before the embargo was due to lift. Multiple proof-of-concept exploits appeared on patch day, and Amazon thinks several threat actors were involved. According to ZDNET, one actor tied to PHP2Shell attack chains is trying to deploy a Mirai-style botnet.

Cloudflare said some attackers adjusted payloads based on blocked requests to get past web application firewalls, per TechRadar. Cloudflare turned on firewall rules for all customers, including free plans, about nine hours before disclosure, but warns they are only temporary protection.

Real-world impact so far

Successful attacks appear limited. Yotam Perkal of Pluto Security told TechRadar that reliable code execution requires getting past ASLR, a memory protection that randomizes where code sits in memory. He said many public proofs of concept do not work reliably, but expects exploits to improve and notes most PHP servers remain unpatched.

The disruption has still been broad. Several European government websites went dark after CERT-EU warned that unpatched sites might need to go offline, The Next Web reports. In Japan, Mitsubishi UFJ Financial Group suspended some internet services, according to Reuters as cited by The Next Web, and the Finance Ministry halted some content and services.

New guidance and what to watch

In an Oct. 23 advisory, the PHP Project told users to set session.upload_progress.enabled=0 until the next scheduled bug-fix release. This guards against a separate and, in its view, unlikely RCE vector, CVE-2026-115560. It requires an application to switch session.serialize_handler to php at runtime with ini_set() before calling session_start(), while upload progress is still enabled.

The NSA advised heightened awareness in the coming weeks and urged organizations to inventory systems that depend on vulnerable PHP versions. Matthew Weier O'Phinney of Perforce Zend and OpenLogic told ZDNET that most open source and commercial LTS distributions had patches within hours of the coordinated release, so a system package manager update is often enough.

Key open questions are how the early attacker obtained exploit details, whether Amazon's payload analysis shows working attacks, and how quickly public exploits become reliable.

Sources

  • The Next WebCloudflare sees millions of attempts to exploit critical PHP flaws↗
  • TechRadarAWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts↗
  • ZDNETPHP2Shell: Haven’t patched yet? Take these steps now to mitigate↗

HOW THIS WAS MADE · Written by the TechWorthIt Desk with AI assistance from 3 published sources, linked above. Facts are cross-checked against those sources before publishing; we never claim testing we didn't do. Last updated Oct 23, 2026. Spotted an error? Tell us.

techworthit
01 Latest02 News