Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward
Matthew Prince /@eastdakota:
Context & Ripple Effects
The PHP2Shell disclosure arrived after an attempted exploitation four days before patches were public, making the vulnerability an active-response event rather than a purely theoretical flaw. Cloudflare had already enabled default WAF mitigations for its free and paid customers roughly nine hours before disclosure.
Prince's traffic figures show how quickly public technical detail translated into automated probing across Cloudflare's network, putting patching and edge-layer defenses on parallel tracks.
First-order effects
- Cloudflare customers received the company’s pre-deployed WAF mitigation by default as exploit attempts jumped from thousands before disclosure to millions afterward.
- PHP site operators outside that protection layer face an immediate surge in automated attempts and must prioritize the disclosed patches and their own compensating controls.
Second-order effects
- Other CDN and WAF providers are pressured to turn signatures into default protections quickly, since a post-disclosure attack wave can arrive before every customer has patched.
- Hosting providers and managed-service firms must treat edge filtering as a bridge to patching, not a replacement for it, because the reported pre-disclosure attempt indicates attackers were already testing the flaws.
Third-order effects
- The episode points to a shrinking window between vulnerability disclosure and mass exploitation, increasing the value of providers able to deploy protections across many customers by default.
- If pre-disclosure exploitation becomes more common for broadly deployed software, coordinated patch releases and pre-positioned mitigations will matter as much as the public advisory itself.
The trend: Critical software disclosures are becoming coordinated defense races in which cloud-edge providers seek to blunt automated exploitation before customers can complete patching.
Related: Cloudflare · Matthew Prince · AWS reports pre-disclosure PHP2Shell exploitation · Cloudflare deploys default PHP WAF mitigations · PHP2Shell vulnerability disclosure
Related Coverage
- Cloudflare sees millions of exploit attempts after PHP disclosure Reuters
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure The Register · Carly Page
- PHP vulnerabilities spark global scramble as websites taken down ITPro · Ross Kelly
- Hackers launch ‘millions’ of attempts to exploit global PHP cyber flaw Politico · Sam Clark
- Coinbase, Bitgo Say Unaffected by PHP Flaw; Binance's CZ Urges Caution Bitcoin News · Linas Kmieliauskas
- PHP2Shell Exploitation Attempt Detected by Amazon Four Days Before Vulnerability Disclosure Infosecurity · Kevin Poireault
- PHP2Shell Exploitation Started Days Before Patches SecurityWeek · Ionut Arghire
- Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure Cloudflare
- The Internet Is Currently On Fire Kotaku · Lewis Parker
- Race to update services' computer systems after cyber-security flaw found BBC · Tom Gerken
- Cloudflare Reports Millions of Exploit Attempts After PHP Flaws Disclosed PYMNTS.com
- Quest Diagnostics Reports Unauthorized Access of Patient Records Gizmodo · Matt Novak
- 911 Outages Hit Multiple Cities in California Gizmodo · Matt Novak
- What Is PHP? Why Are Government and Business Websites Going Offline? New York Times
- Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot Amazon Web Services · CJ Moses
- The internet's hidden security nightmare — and how AI exposed it Axios · Herb Scribner
- Amazon says PHP2Shell exploitation began 4 days before patches BleepingComputer · Sergiu Gatlan
- Global Rush to Fix Security Flaw Uncovered by A.I. Leaves Sites Offline New York Times · Lynsey Chutel
- Asian governments step up cyber defences after PHP flaw Reuters
- Tech And Security Companies Respond To PHP2Shell Vulnerabilities SecurityWeek · Eduard Kovacs
- Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ Financial Times
- The disastrous PHP vulnerabilities were exploited days before the patch The Verge · Emma Roth
- PHP2Shell Exploitation: Two Critical PHP Flaws Explained Recorded Future
- Websites across world hit by millions of attempts to exploit PHP code flaw The Guardian
- PHP2Shell sparks a global patch panic Metacurity · Cynthia B Brumfield
- No, the internet isn't dying due to ‘one of the most significant vulnerabilities of 2026’ - but this is what you need to know TechRadar · Darren Allan
- PHP2Shell: How AI Turns a Stalled PHP Flaw Into a Global Emergency WinBuzzer · Markus Kasanmascheff
- Amazon Logged a PHP2Shell Exploit Attempt Four Days Before Disclosure Implicator.ai · Marcus Schuler
- AI assisted audit uncovers PHP flaw exposing up to 70% of websites AI Policy Daily
- PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August Wall Street Journal · Robert McMillan
- Amazon Threat Intel saw PHP2Shell exploit attempts on 17-Oct, four days before public disclosure. For affected: patch urgently *and* investigate back to at least 17-Oct for signs of compromise: https://aws.amazon.com/... @joebeone@techpolicy.social · Joseph Lorenzo Hall, PhD
- Amazon identifies Oct 17 PHP2Shell exploitation prior to public disclosure Hacker News
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- Usage statistics of PHP for websites W3Techs
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- Critical security issue affecting PHP National Cyber Security Centre
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- Firms Race to Fix Widespread Cyber Flaw Before Hackers Break In Bloomberg Law · Ryan Gallagher
- There isn't an easy exploit for this PHP vulnerability Elias Taylor
- PHP security flaws trigger global scramble; CERT-In flags critical vulnerabilities Times of India · Shilpa Phadnis
- Why did huge swathes of the internet suddenly go offline yesterday? The Irish Times · Stephen Conneely
- How worried should we be about the PHP cybersecurity crisis? Metro.co.uk · Josh Milton
- Gov'ts scramble to patch websites after AI uncovers hidden PHP flaws Korea JoongAng Daily · Sung Ji-Won
- Hackers Race to Exploit Newly Found PHP Vulnerabilities Worldwide Bitcoin Insider
- Firms here should ‘act now’ to fix critical PHP vulnerabilities: Singapore's cybersecurity chief The Business Times
- What is PHP and how has it raised hacking fears? RTÉ
- Worldwide website emergency explained: How a critical PHP weakness sparked a global cybersecurity alert - and exactly what it means for you Daily Mail · Wiliam Hunter
- 110,000 Korean Servers Exposed to Critical PHP Flaws Seoul Economic Daily
- There's an internet-wide security crisis, but crypto might actually be ahead of the curve Yahoo Finance
- PHP security alert: What US and Indian government warnings mean for websites The Indian Express · Bijin Jose
- Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond CNBC · Jenny Lee
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) SOPHOS
- The entire internet is officially in crisis mode Polygon.com · Patricia Hernandez
- A report claims exploit tool PHP2Shell enables RCE on PHP sites; watchTowr says two vulnerabilities affect every version since PHP 5, which was released in 2004 Ars Technica · Dan Goodin
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- What to know about the AI-detected security bug impacting wide swaths of the internet Livemint
- Hackers appear to be struggling to exploit PHP flaws after global cybersecurity crisis NBC News · Kevin Collier
- PHP flaws draw millions of hacking attempts amid global push for fixes FCW · David DiMolfetta
- The race to fix huge PHP code flaw at the heart of the internet - The Latest The Guardian
Discussion
-
@ctrlaltdwayne
Dwayne
on x
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have th…
-
@bettycjung
Betty C. Jung
on bluesky
Millions of hacking attempts as companies, governments rush to patch PHP flaws www.reuters.com/world/asia-p...
-
r/PrepperIntel
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/news
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/worldnews
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
@lukolejnik
Lukasz Olejnik
on x
PHPocalypse flaws existing for a decade, identified with the help of AI, let attackers hijack web servers without logging in. Amazon & Cloudflare reported exploitation attempts days before disclosure. Now the flaws are broadly exploited. Cybersecurity agencies (US, UK, EU, you na…
-
@anthonyronning
Anthony Ronning
on x
Yeah I mean honestly, a significant CVE where multiple people independently found the vulnerability at nearly the same exact time should not be sat on for 2 months. Not only was this irresponsibly disclosed but it was irresponsibly held back too. I'm not sure how that happens.
-
@sughanthans1
@sughanthans1
on x
aws says a 7-day patch deadline is now too slow for critical bugs in anything facing the internet. it wants teams to measure patching in hours. php2shell shows why. aws's honeypots logged an exploit attempt on october 17, four days before the bug went public. and aws spotted expl…
-
@jeremy_kirk
Jeremy Kirk
on x
Amazon detected PHP2Shell exploitation on a honeypot four days before public disclosure: https://aws.amazon.com/...
-
@dinodaizovi
Dino A. Dai Zovi
on x
Periodic reminder that for every serious, exploitable vulnerability that you find out about and patch, there was some level of exploitation of it *before* then.
-
@frichette_n
Nick Frichette
on x
Turns out details leaked even sooner than previously believed. AWS saw exploitation on the 17th! https://aws.amazon.com/...
-
@4n6lady
@4n6lady
on x
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure. Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now. https://aws.amazon.com/...
-
@dnvolz
Dustin Volz
on x
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” https://aws.amazon.com/...
-
Giovanni Ferraz
Giovanni Ferraz
on linkedin
Someone tried to exploit PHP2Shell four days before it was disclosed. — On October 21, PHP shipped emergency fixes for two flaws in its core runtime, CVE-2026-109618 and CVE-2026-109619. …
-
CJ Moses
CJ Moses
on linkedin
Two critical PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619), known as PHP2Shell, are being broadly exploited in the wild. …
-
Peter White
Peter White
on linkedin
70% of the world's websites depend on PHP, and the National Security Agency has just issued an urgent advisory regarding two critical vulnerabilities. …
-
@ericjgeller.com
Eric Geller
on bluesky
Amazon says its telemetry shows attempts to exploit the PHP vulnerabilities on Oct. 17, four days before they were disclosed. aws.amazon.com/blogs/securi...
-
@brbarrett
Brian Barrett
on bluesky
At least one hacker found—and used—the PHP vulnerabilities before they were disclosed. And of course now everybody's getting in on it. from @lhn.bsky.social
-
@couts
Andrew Couts
on bluesky
NEW: AWS detected attempts to exploit the PHP vulnerabilities on October 17, four days before they were patched. Logs indicate multiple malicious actors tried to use the flaws. @lhn.bsky.social reports: www.wired.com/story/hacker...
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@mattburgess1
Matt Burgess
on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire