PHP2Shell: hacking attempts hit the millions as CISA says patch PHP now or take sites offline

The two critical PHP flaws now being called "PHP2Shell" are under heavy attack. Cloudflare CEO Matthew Prince said his company saw thousands of exploitation attempts in the 10 hours before the bugs were made public, tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and millions since, according to The Register. Cloudflare also sees attackers adjusting their payloads to slip past its web application firewall, apparently using feedback from blocked requests. We follow up our earlier report on the disclosure.

What is confirmed

• The bugs: CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale, allow unauthenticated remote code execution, per Tenable and CISA.
• The fixes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21.
• Earlier activity: Amazon Threat Intelligence says its honeypot caught an exploitation attempt on October 17, four days before the patches, and more on October 21 from what it believes are multiple actors, Tenable reports. Tenable advises investigating from October 17, not the disclosure date.
• Disputed: CISA said at publication it had not observed exploitation, while watchTowr and Hadrian say they have. The PHP Foundation said its review found no functional exploits at release. Attempts are not the same as successful break-ins, and Amazon said success on real systems is unclear.

What CISA says

CISA\'s alert urges immediate patching, starting with internet-facing systems, and an inventory of every system running PHP, including PHP bundled inside other software. If you cannot update right away, or you run PHP 8.1 or older, CISA says to take PHP-based systems offline until they are patched or upgraded. It says a web application firewall may offer some protection in the meantime, and to watch for PHP worker processes launching shells or downloading tools. CISA is the only agency whose alert we read directly; we did not find a primary advisory from other agencies, so we do not attribute the same wording to them.

Why it is hard to spot

CrowdStrike\'s analysis says the worker process does not crash and the server returns a normal HTTP 200. The only server-side trace it describes is one memory-limit fatal error in the web server log, containing "in Unknown on line 0", which is easy to dismiss as noise. Application logs show nothing unusual. Once in, an attacker runs commands as the web server user and can plant web shells and read credentials from configuration files, CrowdStrike says.

How many servers

Viral posts cite 2.6 million internet-facing PHP servers and 1.1 million end-of-life ones. We could not tie either figure to a scan we could read, so we are not repeating them. The numbers we can source: researcher Silas Cutler estimates more than 1.3 million internet-exposed hosts are potentially vulnerable, and a Shodan search by Henk Poley counts more than 1.9 million hosts running PHP, per Tenable. Both are estimates. PHP 5.4 through 7.3 are end-of-life with no fix from the project, and 7.4 to 8.1 get only minimal source backports.

Patching may not be enough

A patch stops new exploitation. It does not delete a file an attacker already wrote. None of the vendor pages we read say patching removes an existing backdoor, which is our reading of how patches work rather than a vendor statement, so treat any server that was exposed since October 17 as possibly compromised until checked.

Checklist for site owners

1. Check your PHP version (php -v, or your host\'s control panel) and ask your host or developer about PHP bundled in other software.
2. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, then restart every PHP worker.
3. If you run 8.0, 8.1 or older, upgrade to a supported branch; if you cannot yet, take the site offline per CISA.
4. Look for PHP files you did not put there, especially in upload, cache and temp folders, and for recently modified files since October 17.
5. Rotate database, admin, API and payment credentials stored on the server, after cleaning it.
6. Check notices from your host. On shared hosting you depend on their patch schedule: ask in writing.

Two other incidents, not linked to PHP2Shell

Japan\'s GMO Internet suspended servers on all plans of its Onamae.com Desktop Cloud after malware was found on customer servers, with 26,739 servers potentially affected and customers reporting unauthorized trading-account activity, according to its own notice. The notice does not mention PHP, so we do not connect the two. Separately, India\'s eMudhra revoked eight intermediate certificates whose private keys were trivially weak, one of them reportedly the number 4, per The Register. That is also unrelated.

Sources: CISA, Tenable, CrowdStrike, The Register, GMO Internet, linked above. This is general information, not security advice for your specific systems.