Hackers have launched millions of attempts to exploit two critical PHP vulnerabilities within hours of their public disclosure, prompting businesses and government agencies worldwide to rush out security patches and temporarily shut down online services.
Cloudflare CEO Matthew Prince revealed the dramatic rise in attack activity in a post on X. The company detected thousands of exploitation attempts across its network in the 10 hours before the vulnerabilities were publicly announced. The figure rose to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the following night, according to Reuters.
The vulnerabilities, collectively known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity rating of 9.2 under CVSS version 4.0 and affect the PHP runtime, a widely used technology for powering websites and web applications. Depending on the vulnerable configuration and attack path, successful exploitation can allow unauthenticated attackers to execute malicious code remotely, access sensitive data in memory, or disrupt services.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
According to Cloudflare’s security analysis, the flaws affect web servers running PHP 5.4 and later. One vulnerability involves memory corruption during out-of-memory error handling, while the other involves stale references to memory during request cleanup. Attackers can target vulnerable systems by sending specially crafted HTTP requests, potentially triggering the flaws before application-level security controls have a chance to intervene.
The impact has extended beyond individual websites. According to Reuters, organizations and public agencies in Europe and Asia temporarily suspended some online services while applying fixes and checking their systems. In Japan, organizations including Mitsubishi UFJ Financial Group, ANA and East Japan Railway reported suspending certain internet services as part of precautionary measures. Japan’s Ministry of Finance, Meteorological Agency and National Tax Agency also temporarily restricted or suspended some online services.
Government web services in Finland and several European countries were also affected by precautionary shutdowns. Finland’s state IT services provider Valtori said its actions were not prompted by exploitation of the flaws or a cyber breach. These temporary shutdowns should not be interpreted as evidence that every affected organization was hacked.
The urgency comes from the combination of the vulnerabilities’ severity, their potential to permit remote code execution without authentication, and the speed at which attackers began trying to exploit them. The vulnerabilities were disclosed by researchers associated with Calif.io, Wiz, OpenAI and Quarkslab. Reuters reported that artificial intelligence helped uncover the flaws, highlighting how AI-assisted security research can expose serious software weaknesses while also increasing pressure on defenders to respond quickly.
The good news is that PHP developers have released security updates. The official PHP security advisory recommends upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the installed release branch. These updates address both CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older versions no longer receive regular security updates from the PHP project, although some operating system vendors and long-term support providers may offer backported fixes.
Cloudflare has also deployed web application firewall protections to help block exploitation attempts. The company said its protections were in place approximately nine hours before public disclosure. Rules are available through its managed security offerings, including the Managed Free Ruleset, and Cloudflare says customers using its Managed Ruleset are protected by default. Paid-plan customers should verify that their ruleset is deployed in blocking mode.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
However, a web application firewall should be treated as an additional layer of defense rather than a replacement for installing the official PHP updates. Website owners should check the PHP version actually running on their servers, confirm that their hosting provider has applied the appropriate fix, and review security logs for suspicious requests or signs of compromise. Organizations unable to patch immediately should follow the official advisory’s temporary mitigation guidance or consider taking exposed services offline until they can be secured.
