Attackers have started to exploit the critical PHP2Shell vulnerabilities just four days prior to the release of patches, as reported by Amazon.com Inc. Cloudflare Inc. has observed that exploit attempts have surged into the millions since the vulnerabilities were disclosed.
The maintainers of PHP released fixes for two significant flaws, identified as CVE-2026-109618 and CVE-2026-109619, on Wednesday, following the premature leak of details before a coordinated release. These vulnerabilities had remained in PHP’s code for years, until an audit funded by OpenAI Group PBC in August revealed their exploitability using an artificial intelligence model.
Amazon’s MadPot honeypot network recorded the earliest exploitation attempt on October 17, while the vulnerabilities were still under embargo. The traffic originated from an IP address associated with a commercial anonymization network. CJ Moses, Chief Information Security Officer of Amazon Integrated Security, commented in a blog post that it remains unclear how the attacker acquired information about the exploits before public disclosure.
Additional probing attempts increased significantly in the hours leading up to the Wednesday announcement, with varying payloads and anonymized infrastructure suggesting involvement from multiple actors. The effectiveness of these early attempts on actual systems is still uncertain. Shortly after the patch release, new proof-of-concept exploits emerged and were detected by Amazon’s sensors. The company now categorizes the vulnerabilities as “being broadly exploited in the wild.”
Amazon has recommended that investigations begin from October 17 at the latest, arguing that the traditional remediation timelines of seven and 30 days for critical internet-facing flaws fail to account for the immediate actions taken by attackers. The company advocates for patch timelines measured in hours.
Following the public disclosure, exploit traffic recorded by Cloudflare increased significantly. The network noted “thousands of attempts” in the ten hours prior to the announcement, according to Chief Executive Matthew Prince, who reported on X late Wednesday. This was followed by tens of thousands of attempts in the 45 minutes after the announcement, and hundreds of thousands within two hours, culminating in over a million exploit attempts shortly thereafter.
As of now, none of this traffic has been linked to confirmed breaches. WordPress security firm Defiant Inc. reported today that its Wordfence firewall has blocked over 74,000 exploit and probing attempts across the more than 5 million WordPress sites it protects, with no confirmed compromises thus far. Dataminr Inc., a real-time event and risk detection company, characterized the observed activity as “limited to scanning, fingerprinting, and the use of non-working exploits,” adding that functioning attacks are “only a matter of time.”
In response to the vulnerabilities, organizations worldwide have preemptively taken services offline. Various cybersecurity agencies, including the U.S. National Security Agency, advised on Wednesday that systems should be taken offline if immediate updates were not feasible. Consequently, reports from Reuters indicated that banking, rail, and government services in locations from Tokyo to Helsinki were temporarily shut down as a precaution.
In Japan, firms like Nomura Holdings Inc., Mitsubishi UFJ Financial Group Inc., and East Japan Railway Co. suspended certain internet services. Additionally, the National Tax Agency temporarily deactivated its service. South Korea raised its private-sector cybersecurity alert level, citing increased hacking risks.
In Finland, the state information technology services provider, Valtori, lifted blocks on government web services after applying patches overnight. Director General Hannu Naumanen indicated that the restoration process could take “days or even weeks” due to the need for thorough testing.
Microsoft Corp. CEO Satya Nadella remarked at an event in Germany that he had “not seen anything like this in a long, long time,” according to Reuters. He noted that it had been a “long day and a long night” for IT and security personnel.
Michael Centrella, head of public policy at SecurityScorecard Inc. and a former assistant director of the U.S. Secret Service, suggested that agencies should prioritize exposed systems based on their mission impact, encompassing factors such as public safety, health, and financial transactions. “What appears to be hundreds of separate vulnerabilities could indicate a smaller number of shared points of failure that could lead to cascading disruptions,” he added.
Smaller operators may not implement the necessary fixes, according to Felix Kuhlenkamp, head of security at the German digital industry association Bitkom. He stated that many small operators use PHP for their websites but often lack stringent oversight. If a site operates on an outdated version without any security updates, he emphasized, “the entire system must be updated.”
“The end-of-life count should be alarming,” remarked Justin Beals, founder and CEO of Strike Graph Inc.. He referenced data from vulnerability intelligence firm VulnCheck Inc. that indicates over 1 million internet-facing hosts are running PHP versions that no longer receive updates. “Any system categorized as end-of-life should be included on a risk register with a designated owner and a retirement date,” Beals concluded.
Concerns about plugins and other dependencies tying applications to specific PHP versions exist, as updates to PHP could disrupt critical business operations, according to John Strand, owner of Black Hills Information Security Inc.. He stated, “While ‘just patch it’ may sound straightforward, such updates can lead to website outages. Faster identification of vulnerabilities does not equate to quicker fixes. The struggle to patch already known vulnerable systems persists, and the industry is unprepared for the widening gap.”