Cloudflare CEO Reports Millions of PHP2Shell Exploit Attempts

Back Thedefiant

Cloudflare CEO Reports Millions of PHP2Shell Exploit Attempts

Thedefiant • October 22, 2026

Share: View original

PHP has shipped fixes for four supported branches. The flaws can let attackers run code on vulnerable web servers without logging in.

Loading this article…

Our articles are stored on Filecoin.

Good reporting. Delivered.

Choose your coverage: crypto and DeFi, the future of finance, or both.

Railway Urges All Users to Rotate Secrets After Security Incident

Japan's Prime Minister Urges PHP Patching, Suggests Temporary Site Shutdowns

CoinDCX Co-Founder Denies New Hack After $16 Million Wallet Alert

Developer Links $370,000 Theft to Railway Secrets Exposure

Tesla and SpaceX Explore Merger That Could Unite 30,221 Bitcoin

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PHP2Shell: Critical RCE Vulnerabilities Prompt Emergency Patches Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed on October 21, 2026, allowing unauthenticated remote code execution (RCE). The vulnerabilities, collectively known as PHP2Shell, affect all PHP installations serving web requests, including popular platforms like WordPress and Drupal. Exploitation attempts were observed as early as October 17, four days before the patches were released. The PHP security team released emergency patches for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, but older versions such as PHP 8.1 and below will not receive official fixes. Organizations are urged to patch immediately or isolate affected systems to mitigate risks. The vulnerabilities were discovered by researchers at Wiz and Calif, with assistance from OpenAI's AI models. 785 sources 73

Extracted Entities

Attack Types (1)

Companies (4)

Cloudflare CoinDCX SpaceX Tesla

Countries (1)

Platforms (2)

Filecoin Railway

Tools (1)