Two critical vulnerabilities in PHP, collectively nicknamed PHP2Shell, have triggered a surge in exploitation attempts that Cloudflare CEO Matthew Prince described as moving from thousands to millions within hours of official patches being published.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were patched on Wednesday, October 21. According to Prince, Cloudflare's own network recorded a jump in attack attempts almost immediately after the fixes went live, as opportunistic actors raced to exploit servers that had not yet been updated.
Evidence gathered separately points to exploitation predating the official disclosure. The first attempts against servers vulnerable to the two CVEs were logged on October 17, four days before the patch release. Those early scans targeted test environments and originated from a commercial anonymization network, according to the available data. Details of the underlying flaws then leaked online on October 20, the day before the official patch, giving attackers an additional window to prepare before the fix became public.
Amazon has published a security report covering the early wave of attacks, documenting the pattern of activity that preceded the formal disclosure and patch cycle.
Scale of exposure
The scale of the vulnerable population is significant. Internet-scanning firms Censys and VulnCheck estimate that between 1.5 and 2.6 million internet-exposed servers are still running unpatched versions of PHP affected by these flaws. Separately, more than 800,000 machines are reported to be running PHP versions that have already reached end of life, meaning they will not receive official security updates regardless of the current patch cycle.
For European organisations, the exposure figures are relevant because PHP remains widely used across web infrastructure on the continent, including by public-sector and institutional operators that often run older software stacks. The speed with which exploitation attempts escalated after the patch's release underscores how quickly automated scanning tools can weaponise a disclosed flaw once it becomes public, leaving a narrow window for administrators to apply fixes before servers are targeted at scale.
The PHP Foundation, which maintains the language, issued the patches addressing both CVEs. No further technical guidance beyond the patch release has been detailed in the material reviewed for this report.
