Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Context & Ripple Effects
PHP2Shell was disclosed as a critical issue with broad exposure, while AWS analysts reported at least one attempted exploitation four days before disclosure. Cloudflare had already enabled default WAF mitigations for its free and paid customers roughly nine hours before the announcement, making its network a useful view of how quickly public disclosure changes attacker behavior.
The jump in observed attempts shows the operational gap between a vulnerability becoming public and every affected operator applying a fix. It also reinforces the significance of pre-disclosure exploitation observed by AWS, when defenders have little time to prepare.
First-order effects
- Cloudflare’s default WAF rules give its free and paid customers an immediate protective layer as PHP2Shell scanning and exploitation attempts scale from thousands to millions.
- Organizations operating affected PHP deployments face an urgent remediation cycle because public details have rapidly made the flaw a target for broad automated probing.
Second-order effects
- Cloudflare’s early deployment raises the bar for hosting providers and other web-application firewall vendors: customers will expect mitigations to be available before or at disclosure, not after exploit traffic peaks.
- AWS’s evidence of attempted exploitation before patch publication means incident-response teams must treat the disclosure timeline as potentially shorter than the public announcement suggests.
Third-order effects
- PHP2Shell strengthens the case for a vulnerability-coordination model in which edge mitigations, cloud telemetry, and vendor patches are staged together, because disclosure can immediately turn a limited threat into mass scanning.
- If this response pattern persists, defensive advantage will increasingly depend on remediation throughput—how quickly protections reach managed customers—rather than on detection alone.
The trend: Critical software disclosures are becoming tests of the discovery-to-remediation pipeline, with automated attackers converting public vulnerability details into internet-scale activity within hours.
Related: Discovery–remediation throughput gap · Vulnerability coordination layer · Cloudflare · AWS reports attempted PHP2Shell exploitation before disclosure · Cloudflare deploys PHP2Shell WAF mitigations by default
Related Coverage
- Race to update services' computer systems after cyber-security flaw found BBC · Tom Gerken
- Cloudflare sees millions of exploit attempts after PHP disclosure Reuters
- Global Rush to Fix Security Flaw Uncovered by A.I. Leaves Sites Offline New York Times · Lynsey Chutel
- PHP2Shell exposes the weakness in coordinated vulnerability disclosure CSO · Taryn Plumb
- Amex Says App and Website Disruptions ‘Not Caused by a Security Vulnerability’ Gizmodo · Matt Novak
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure The Register · Carly Page
- PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions SiliconANGLE · Duncan Riley
- Cloudflare Reports Millions of Exploit Attempts After PHP Flaws Disclosed PYMNTS.com
- Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure Cloudflare
- AI Is Changing Everything About Hacking. No One Knows What Happens Next 404 Media · Jason Koebler
- What Is PHP? Why Are Government and Business Websites Going Offline? New York Times
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities Central Security Service · National Security Agency
- PHP releases emergency fixes for 2 critical vulnerabilities CyberScoop
- Websites taken down worldwide as critical cyber-security update issued BBC
- PHP2Shell Leak Sends Security Teams Scrambling Forrester · Sandy Carielli
- Cyber agency warns websites may go dark as PHP prepares critical fix Reuters
- PHP has critical vulnerabilities impacting millions of websites, emergency patch out [Update] Neowin · Usama Jawad
- “Even some world leaders weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister...” — good morning! — https://www.reuters.com/... @n0toose@chaos.social
- Usage statistics of PHP for websites W3Techs
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- The internet's hidden security nightmare — and how AI exposed it Axios · Herb Scribner
- Introducing Machine Gods Platformer · Casey Newton
- Amazon warns new cyber flaws detected using AI are being ‘broadly exploited’ Financial Times
- [critical] PHP2Shell: critical unauthenticated RCE in PHP core pwn.watch
- What to know about the AI-detected security bug impacting wide swaths of the internet Livemint
- The PHP bug marks a dangerous new era for the internet. OpenAI's poised to cash in Fortune · Emily Forlini
- [Reading Science] AI Uncovers a Critical Internet Vulnerability... Worldwide on Alert The Asia Business Daily · Kim Jonghwa
- South Korea Has 110,000 Hosts Vulnerable to Critical PHP Flaws ETNEWS
- PHP flaws draw millions of hacking attempts amid global push for fixes FCW · David DiMolfetta
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- There's an internet-wide security crisis, but crypto might actually be ahead of the curve Yahoo Finance
- The Internet Is Currently On Fire Kotaku · Lewis Parker
- Critical security issue affecting PHP National Cyber Security Centre
- PHP security alert: What US and Indian government warnings mean for websites The Indian Express · Bijin Jose
- Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond CNBC · Jenny Lee
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching Wired · Lily Hay Newman
- The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online The PHP Foundation
- Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) SOPHOS
- The entire internet is officially in crisis mode Polygon.com · Patricia Hernandez
- PHP's creators disclose a critical memory-management vulnerability, dubbed “PHP2Shell”, that affects up to 70% of websites, discovered via GPT-5.6 Sol in August Wall Street Journal · Robert McMillan
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- Rush is on to patch a software vulnerability that could impact 70% of websites worldwide Associated Press
- Major US, Europe Websites Go Dark to Protect Against PHP Vulnerabilities the NSA Found Tech Times · Isaiah Richard
- The disastrous PHP vulnerabilities were exploited days before the patch The Verge · Emma Roth
- PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update PHP
- Japan to simulate cyberattacks as PHP flaws roil global internet Reuters
- The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days CNN · David Goldman
- [PHP Security Alert] Millions of Attack Attempts Within Hours of Flaw Disclosure The Asia Business Daily · Lee Eunseo
- Hacking attempts rise after flaws found in program affecting 70 percent of websites NPR · Kate Bartlett
- 🚨 The Night Hacking Hit Machine Speed Superintelligence
- PHP2Shell exposes the weakness in coordinated vulnerability disclosure InfoWorld · Taryn Plumb
- AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts TechRadar · Sead Fadilpašić
Analysis
Discussion
-
@noahpinion
Noah Smith
on x
DESTROY THE INTERNET [embedded post]
-
@nikitabier
Nikita Bier
on x
There is nothing to worry about. Nothing important is run on PHP or old software—except the water & electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo (for the lions, tigers and cobras).
-
@redpillrabbit
@redpillrabbit
on x
THIS IS A WARNING TO EVERYONE. The ONLY REASON large companies aren't saying they've been hacked is BECAUSE THEY ARE TOO INCOMPETENT to know. They are staffed with INDIANS with FAKE CREDENTIALS. YOU ARE ALL FUCKED. [embedded post]
-
@citrini
@citrini
on x
I'm kind of worried that we are gonna have massive exploits like every other week [embedded post]
-
@c_c_krebs
Chris Krebs
on x
[image] [embedded post]
-
@ctrlaltdwayne
Dwayne
on x
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have th…
-
@dnvolz
Dustin Volz
on x
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” https://aws.amazon.com/...
-
@bettycjung
Betty C. Jung
on bluesky
Millions of hacking attempts as companies, governments rush to patch PHP flaws www.reuters.com/world/asia-p...
-
r/news
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/PrepperIntel
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/worldnews
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
@ianlandsman
Ian Landsman
on x
Explaining to my wife how there's this one guy. And he alone is responsible for most of the world's distribution of PHP. And if anything happens to this guy, that's just it. Everyone is screwed.
-
@cwarzel
Charlie Warzel
on x
His name is Ondřej Surý and yesterday he kinda saved the internet. I called him up to talk about it! https://www.theatlantic.com/ ... [embedded post]
-
@censysio
@censysio
on x
Two critical PHP vulnerabilities. Widespread Internet exposure. Reuters covers the latest developments, citing Censys research. https://www.reuters.com/... Follow our Censys ARC advisory for the latest findings and updates: https://censys.com/... [image]
-
@cwarzel
Charlie Warzel
on x
70% of the internet was vulnerable yesterday to very bad security flaws inside a coding language. Turns out, *one volunteer* is mostly responsible for maintaining that code & helping push updates. Yesterday Ondřej Surý saved the internet. So I called him up. He rules. https://www…
-
@cwarzel
Charlie Warzel
on x
really exactly the kind of guy you want in charge of something like this
-
@czindublin
@czindublin
on x
🇨🇿 Hats off to Czech tech expert Ondřej Surý! 👏 As critical PHP vulnerabilities put websites worldwide at risk, Ondřej helped provide security updates for older PHP versions, protecting systems that still rely on them. An important reminder that the people working behind the scen…
-
@valerie.vg
@valerie.vg
on bluesky
“This is not because AI has become sentient [...] but because AI is proving something that we have always known: much of the software that runs the internet, our devices, our accounts, and our lives is vulnerable, or out of date, or has security flaws that human beings never noti…
-
@damonberes.com
Damon Beres
on bluesky
“I feel a responsibility toward the users of the internet. It would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea. That could happen. But I had time to prepare the packages.” Hero.
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
Ondřej Surý has been an unsung hero of PHP for many years, and this is a fascinating interview. [embedded post]
-
@rincewind.run
Micah
on bluesky
literally this comic except he apparently lives in Czechia instead of Nebraska [embedded post]
-
@chemotaxis
@chemotaxis
on bluesky
holy shit this guy rocks and maybe is the patron saint of Operations [embedded post]
-
r/LabourUK
r
on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@vlad_mihalcea
Vlad Mihalcea
on x
Simplicity and flexibility always win. That's why PHP has a 80% market share of all Internet websites. https://w3techs.com/... [image]
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@mattburgess1
Matt Burgess
on bluesky
“Updating is the only safe choice” — As PHP releases the details of its critical vulnerabilities, governments around the world are taking their websites offline for updates. — Security researchers warn things could be real bad if systems aren't patched immediately — Story w…
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@bayeslord
Bayes
on x
Millions of attempted exploits. I'm confused. Where is the impact? [embedded post]
-
@bitcoinpalmer
@bitcoinpalmer
on x
Guys I know I meme and pasta a lot But I'm 100% struggling to see how this isn't a massive black swan otw [embedded post]
-
@mrsdeborahlynn
Deborah Lynn
on bluesky
www.reuters.com/world/asia-p... Millions of hacking attempts as companies and governments deployed patches and suspended websites as a precaution, according to cloud services firm Cloudfare. — Details of these flaws became public before fixes were ready. — #Blues