Millions of Attempts to Exploit Critical PHP Vulnerability, Reports Cloudflare CEO

What happened

On October 22, 2026, Cloudflare CEO Matthew Prince said that attacks trying to use the PHP2Shell flaw rose very fast. About 45 minutes after the flaw was announced, attempts reached tens of thousands. Within 2 hours, they reached hundreds of thousands, and then millions. Cloudflare counted these attempts across its whole network. PHP2Shell refers to two "critical" flaws in PHP, a popular programming language for websites. PHP's developers released fixed versions around 11 p.m. on October 21 (Japan time).

Key numbers

• About 10 hours before the announcement: several thousand attempts
• 45 minutes after the announcement: tens of thousands of attempts
• Within 2 hours: hundreds of thousands of attempts
• After that: millions of attempts
• Two flaws: CVE-2026-109618 and CVE-2026-109619

Some basic terms

A security flaw is a weak spot in software that bad actors can use to break in. Hackers try to use a flaw as soon as they learn about it. Cloudflare says it added firewall rules before the full details were public. A firewall rule is a set of instructions that blocks harmful traffic before it reaches a website.

Why it matters

Many websites run on PHP, so this flaw could affect a lot of services. Some companies stopped their services for emergency maintenance to fix the problem. The fast rise in attacks shows how quickly bad actors act once a flaw is public. Users should update PHP quickly, because waiting can leave their sites open to attack.

What to watch

• Whether more companies apply the fixed PHP versions
• Whether attack numbers keep rising or start to fall
• Whether more details about who is behind the attacks come out