Skip to content
PHP2Shell Exploit Triggers Millions of Attacks on Cloudflare

PHP2Shell Exploit Triggers Millions of Attacks on Cloudflare

First seen 22 Oct 2026, 21:44 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 22, 2026 at 23:13 UTC
  • •Cloudflare experienced millions of attack attempts within hours of PHP2Shell exploit disclosure.
  • •The surge in attacks indicates a rapid shift from probing to mass exploitation.
  • •AWS detected exploitation attempts before the public announcement, suggesting preemptive targeting.

Cloudflare CEO Matthew Prince reported that the PHP2Shell exploit led to thousands of attack attempts on the Cloudflare network within 10 hours before its public disclosure on October 22, 2026. Following the announcement, the number of attacks surged to hundreds of thousands in just two hours, escalating to millions by the end of the day. The attacks targeted two critical PHP vulnerabilities, with AWS having detected exploitation attempts prior to the public disclosure. The figures reported count attempts rather than confirmed compromises, indicating a significant threat landscape for PHP-based applications. The rapid escalation from probing to mass targeting highlights the urgency for organizations to assess their exposure to these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-22
PHP2Shell exploit disclosed
Cloudflare CEO Matthew Prince announced the PHP2Shell exploit, leading to a massive surge in attack attempts.
Theverge
2026-10-22
Attack attempts surge
Attack attempts rose from thousands to millions within hours of the exploit's disclosure.
Feeds.4Sysops

More articles in this cluster (2)

Following this threat?

Track Cloudflare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 2

Common questions

What vulnerabilities are being exploited?
The attacks target two critical PHP vulnerabilities associated with the PHP2Shell exploit.
How urgent is the response?
The rapid increase in attack attempts indicates an urgent need for organizations to assess their PHP applications for vulnerabilities.
What should organizations do now?
Organizations should immediately evaluate their systems for the PHP vulnerabilities and implement necessary patches or mitigations.