Attempts to exploit the newly disclosed PHP2Shell vulnerabilities across Cloudflare’s network surged into the millions on Wednesday, climbing from thousands in the 10 hours before public disclosure to tens of thousands within 45 minutes and hundreds of thousands within two hours, CEO Matthew Prince said. Amazon Web Services security researcher CJ Moses added that the flaws first hit AWS MadPot honeypots on Oct 17, four days before the official advisory was released.
The US National Security Agency published technical mitigation guidance to help operators secure their servers, while Binance founder Changpeng Zhao warned users to be “extra careful visiting ANY web site in the next few days” because unpatched servers could be used for credential theft or device exploits. Censys estimates that about 1.5 million servers are running older PHP versions that do not receive official fixes.
Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on the CVSS v4.0 scale, the memory corruption bugs allow unauthenticated remote code execution on web servers running PHP, which powers roughly 70% of websites including WordPress, Drupal, Joomla and Magento deployments. Discovered with the help of AI models from OpenAI and Google, the flaws prompted the PHP Foundation to release patches in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as government agencies and organizations across Europe and the US temporarily pulled websites offline.