Cloudflare Reports Millions of PHP Exploit Attempts After Vulnerability Disclosure

Cloudflare said attempts to exploit two critical PHP vulnerabilities rose from thousands before public disclosure to millions afterward. The flaws can enable unauthenticated remote code execution, and security agencies urged immediate patching while governments and companies temporarily took services offline.

jajoy39

Oct 23, 2026 - 12:11

Oct 23, 2026 - 12:59

0 3

Cloudflare company sign in its Lisbon office (file photo). Image source: Office Snapshots. https://officesnapshots.com/2025/09/30/cloudflare-offices-lisbon/

Cloudflare Reports Millions of PHP Exploit Attempts After Vulnerability Disclosure

Cloudflare said exploit attempts targeting two critical PHP vulnerabilities rose from thousands before public disclosure to millions afterward, illustrating how quickly attackers can operationalize newly available security information. The report came as governments and companies rushed to patch PHP-based systems or temporarily take websites offline.

What changed after disclosure

Cloudflare CEO Matthew Prince said the company saw thousands of attempts in the 10 hours before the vulnerabilities were publicly announced, tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterward. Amazon also reported widespread exploitation attempts. These figures describe observed attempts, not a confirmed number of successful compromises.

Cloudflare's own security post identifies the flaws as CVE-2026-109618 and CVE-2026-109619, collectively called php2shell. It said they affect PHP 5.4 and later and can lead to denial of service, data exposure or remote code execution when specially crafted HTTP traffic is processed.

Patch first, add defenses

CERT-EU said PHP released fixes for supported branches on Oct. 21 and advised organizations to patch immediately, isolating internet-facing applications where patching was not feasible. Cloudflare said its web-application firewall protections were deployed ahead of public disclosure, but stressed that a WAF is defense in depth rather than a substitute for updating PHP itself.

The company's protection uses “full transaction detection,” combining request and origin-response signals to improve confidence and reduce false positives. Cloudflare said customers with its managed WAF received the protections automatically.

A broad operational disruption

Reuters reported temporary shutdowns affecting public, financial and transport services in several countries. Operators on unsupported PHP versions may need vendor backports or an upgrade path. The incident shows why emergency patching can disrupt availability even when there is no evidence that a particular outage was caused by a successful breach.

Illustrative file photo of software code on a monitor; it does not depict an attack or a system involved in this report. Photo: Markus Spiske / Unsplash. Unsplash License; cropped to 16:9. Image source; license.