PHP2Shell patches ship as Cloudflare reports millions of exploit attempts

What got patched

PHP runs behind the scenes on about 70% of websites whose server-side language is known, according to Decrypt. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Wednesday, according to its release notes, and its guidance didn't leave much room: there are no complete mitigations, and updating is the only safe choice. As of Thursday, PHP hadn't issued a follow-up patch.

Here's the catch. PHP doesn't update itself, so hosting companies, IT departments and website owners have to apply the fix on their own servers and then restart the software before it takes effect. Older servers are the weak spot (PHP 8.1 and earlier no longer get official releases), although PHP's security team posted bare-bones patches for 7.4, 8.0 and 8.1 for people who compile the software themselves.

Millions of attempts, no confirmed break-ins

Cloudflare CEO Matthew Prince said in a post on X that his network saw thousands of exploit attempts in the 10 hours before the announcement and tens of thousands in the 45 minutes after it. By his count, attempts hit hundreds of thousands within two hours and have reached millions since.

Amazon's timeline starts earlier. Its decoy servers logged an attempt on October 17, four days before the bugs went public, and Amazon CISO CJ Moses wrote that it's unclear how the attacker got exploit information before disclosure. Moses added that PHP2Shell is "now being broadly exploited in the wild."

Thomas Caspers, vice president of Germany's federal cybersecurity agency BSI, said the agency had seen attacks but no successful use of the flaws. Japan's Chief Cabinet Secretary, Minoru Kihara, said no attacks exploiting the flaws had been confirmed. Both statements cover only what officials had confirmed when they spoke.

For most people, Decrypt said, the risk sits with the websites they visit, not with their own phones or laptops.

The PHP Foundation's admission

In a blog post published Wednesday, the PHP Foundation said its security work in 2024 found the first signs of the out-of-memory problem behind CVE-2026-109618. The team came up with several competing approaches to a fix but struggled to pick one, fearing the consequences of shipping the wrong one.

"We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation wrote

The foundation said that without its funding, it would have been impossible to have several people work on the issue full time. Its security team (which used to need consensus) will now decide by majority.