Cloudflare: php2shell exploit attempts jump from thousands to millions

Cloudflare says exploit attempts against php2shell, a pair of critical PHP flaws found with help from AI models, climbed from thousands before the announcement to millions shortly after it. The company's Prince put the curve this way: "In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."

The disclosure came Wednesday, October 21, from Calif.io, Wiz, OpenAI and Quarkslab. Our earlier report on governments pulling sites offline covers the fallout. This piece is about that headline number, and the several numbers that are missing.

What the flaws are

The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2. Both are memory-handling failures. In the first, PHP runs out of memory and interrupts its work before some internal data is initialized, then uses that unfinished data during request cleanup. In the second, a fatal error interrupts a request and leaves PHP holding references to memory that is released when the request ends. A later request in the same process may follow those stale references and expose sensitive data, according to Cloudflare.

The reach is the problem. Cloudflare says PHP is used by almost 70% of websites, and the flaws affect all web servers running PHP 5.4 or later. CERT-EU is wider: it said every version back to PHP 5, released in 2004, could be affected. Those two scopes do not match.

Wiz says it demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla. It also says the exploit does not depend on a flaw in the application's code, and that "even a simple "Hello World" application running on an affected PHP version can be vulnerable."

The curve, read carefully

Start with the shape. Thousands of attempts across 10 hours became tens of thousands in the first 45 minutes after the announcement. That is a much steeper initial rate. The reported total then reached hundreds of thousands within two hours, and later millions. Public disclosure put the map in public view. The traffic spike followed.

Now the footnote. These are attempts. The figures Cloudflare gave describe probes it saw across its network, not compromised servers. The quote carries no count of successful exploitation, no breakdown of which attempts were scanners and which were attackers, and no baseline for what "thousands" of PHP probes looks like on an ordinary day.

The record is also split on whether anyone is actually getting in. Dutch authorities said Wednesday afternoon that they had observed no signs of active exploitation. Cloudflare reports millions of attempts, and CNBC cited reports that hackers were actively exploiting the flaws. Those can all be true at once: attempts are cheap, and a successful hit on one network is not a statement about another.

One more gap. The pre-announcement "thousands" came after details leaked on social media on Tuesday, which forced the PHP Foundation's hand. The foundation had planned to disclose in late October with a complete fix, the BBC reported. Whether anyone exploited the bugs before that leak is an open question. So is who leaked.

The defense went first

Cloudflare's own timeline is the cleanest part of the story. Starting October 21 at 3:02 am UTC, roughly nine hours ahead of public disclosure, customers on its free or paid WAF were protected by default against php2shell. To do it, Cloudflare built what it calls full transaction detection, a WAF capability that combines signals from the request and the response in the same HTTP transaction. Response rules can then block a matching origin response before it reaches the requester.

That design choice matters because it inspects what the server sends back, not just what arrives. It is a mitigation, not a patch. WAF protection is not a PHP fix; sites running an affected version still need to address the underlying vulnerability.

Governments also took precautionary action. According to Semafor, France, Denmark, Finland and the Netherlands took government websites offline Wednesday. In Japan, Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services, and Prime Minister Sanae Takaichi urged website owners to check whether their sites use PHP and prepare to apply the new fix. The NSA told organizations to take systems offline if they could not update.

The AI part, and who gets the credit

The discovery story is its own argument. Wiz says it found the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, confirmed remote code execution against Drupal on August 20 and WordPress on August 21, and reported the bugs to the PHP security team on August 24. A Wiz co-founder told The Wall Street Journal the exploit is "the most severe AI vulnerability… ever found," and added that humans probably could not have found it without AI, according to Semafor.

Credit is contested. OpenAI says its Patch the Planet initiative led the discovery using its models. Wiz describes a multi-model effort. Google DeepMind credited Gemini 4 Argon. The accounts cited here do not explain how the work divided between finding the bugs and building the exploit. That is the evaluation I would want before anyone declares what AI did here.

What to watch

• Confirmed compromises. Attempts are a weather report. Watch for victims, not probes.
• The fix. Which PHP release numbers contain the fixes?
• Old PHP. Systems on end-of-life versions (PHP 8.1 or older) have an unanswered question: what do they do if upgrading is impossible?
• The leak. Who posted the details, and whether exploitation began before it.

Millions of attempts is a big number. It is not yet an eval of damage.