Cloudflare CEO Reports Millions of PHP2Shell Exploit Attempts

Cloudflare CEO Matthew Prince said the company's network had seen millions of attempts to exploit the PHP2Shell vulnerabilities, including thousands during the 10 hours before they were publicly announced.

PHP has released fixes for the two flaws, which can let attackers run code on vulnerable web servers without logging in. Blockchain security firm SlowMist has urged crypto platforms, DeFi projects and wallet providers to assess their PHP exposure and upgrade.

In an X post published at 9:25 p.m. ET on Oct. 21 (01:25 UTC on Oct. 22), Prince wrote:

> Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Those figures describe network-wide exploit attempts, not a tally of successfully compromised websites.

In a separate technical post, Cloudflare said vulnerability details leaked ahead of the official release and that it observed attack traffic targeting customers. The company said attackers were changing payloads to try to bypass its protections.

PHP Fixes Are Available

PHP's Oct. 21 security releases—**8.5.12, 8.4.27, 8.3.36 and 8.2.35**—fix both vulnerabilities, tracked as **CVE-2026-109618** and **CVE-2026-109619**.

The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM and Apache's mod_php. It considers the risk highest for mod_php, where a demonstrated exploit can trigger an attack before application code runs. The flaws involve unsafe handling of incompletely initialized request data or memory that has already been freed.

For a crypto platform, DeFi front end or wallet provider using affected PHP, updating website code or plugins alone does not fix the underlying runtime flaws. Cloudflare says administrators must update PHP itself, or have their hosting provider do so.

PHP 8.1 and older no longer receive routine project updates. However, PHP's security team has supplied minimal source-code backports for **7.4, 8.0 and 8.1**. Some distributions and long-term-support vendors also provide backported fixes; operators should check their vendor or upgrade to a supported version.

Cloudflare says it deployed web application firewall protections for customers using its free or paid WAF, but still recommends applying the PHP updates. PHP warns that configuration changes can reduce exposure to particular attack paths but do not make an installation safe.

The NSA's cybersecurity account advised organizations that cannot update immediately to take affected systems offline until they can be fully mitigated.