PHP2Shell Vulnerabilities See Millions of Exploit Attempts Before Patches
Attackers targeted PHP flaws days before disclosure, with Cloudflare logging millions of attempts as Amazon confirmed early exploitation.
Key points
- Cloudflare recorded millions of exploit attempts for CVE-2026-109618 and CVE-2026-109619 after public disclosure.
- Amazon detected exploitation attempts on October 17, four days before patches were released.
- Hadrian warned on October 21 that the flaws were being exploited in the wild at scale.
Thousands of websites running PHP software are facing a massive wave of attacks targeting two newly disclosed vulnerabilities. These flaws, identified as CVE-2026-109618 and CVE-2026-109619, allow attackers to gain shell access to servers. The scale of the exploitation has grown rapidly since details became public earlier this week, putting any unpatched PHP installation at significant risk of compromise.
Cloudflare reported a staggering increase in attack volume following the disclosure. CEO Matthew Prince noted that thousands of attempts occurred in the ten hours before the vulnerabilities were publicly announced. Within 45 minutes of disclosure, that number jumped to tens of thousands. By two hours after the announcement, hundreds of thousands of attempts had been recorded, eventually climbing into the millions as attackers targeted the flaws.
View the original post on X
Attack Timeline and Tactics
The exploitation began before the vulnerabilities were publicly known. Amazon Threat Intelligence detected an attempt to exploit PHP2Shell on October 17. This activity was four days before patches were officially released. The detection occurred via MadPot, Amazon's honeypot network designed to lure and record attacker behavior. This early activity suggests that threat actors had access to exploit code prior to the public announcement.
Attackers are actively modifying their techniques to bypass security controls. Cloudflare observed miscreants tweaking their payloads to sneak past web application firewall protections. These attackers appear to be using feedback from blocked requests to determine which variations might succeed. This adaptive behavior makes it harder for automated defenses to stop the intrusion attempts effectively.
Scope of the Threat
Security firm Hadrian raised an alarm on October 21 regarding the widespread exploitation. The company stated that PHP2Shell was being exploited in the wild at scale. Hadrian noted that most observed attacks abuse PHP's session upload-progress path. The firm warned that additional exploit paths are expected to appear both before and after the official fix is shipped to users.
Our take on the response
The rapid escalation from thousands to millions of attempts indicates a highly coordinated campaign. The fact that Amazon detected exploitation four days before patches suggests the vulnerability was known to attackers in advance. The adaptive nature of the payloads, as described by Cloudflare, shows sophisticated evasion techniques. Users should assume that standard firewall rules may not be sufficient against these evolving threats.
For customers and users
Organizations running PHP applications should immediately verify their software versions against the newly released patches. Check server logs for unusual activity, particularly around file upload endpoints, as attackers often target these paths. Monitor for successful login attempts from unfamiliar IP addresses. Be wary of follow-up phishing emails claiming to offer fixes or support for this issue, as scammers often exploit high-profile vulnerabilities to steal credentials.
What to do and how to stay safe: PHP
- Verify that your PHP installation has been updated to the latest version that addresses CVE-2026-109618 and CVE-2026-109619.
- Review web server access logs for spikes in traffic or unusual request patterns, especially involving file uploads.
- Ensure your web application firewall rules are updated to block known exploit signatures for these vulnerabilities.
- Monitor user accounts for unauthorized access or changes to permissions that could indicate a compromise.
Step-by-step guide: Incident Response Plans: How to Stop Damage When Attacks Happen
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the CVE IDs for the PHP2Shell vulnerabilities?
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
When did attackers first start exploiting these flaws?
Amazon detected an exploitation attempt on October 17, four days before patches were released.
How many exploit attempts has Cloudflare recorded?
Cloudflare has recorded millions of exploit attempts since the vulnerabilities were publicly disclosed.
