Attackers swarm PHP2Shell flaws, with exploit attempts spotted days before patches

Attackers are hammering servers with millions of attempts to exploit two critical PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Cloudflare CEO Matthew Prince said the company saw thousands of attempts in the 10 hours before the public announcement. That rose to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and has since reached the millions. Security firm Hadrian reported on October 21 that the flaws were being exploited in the wild at scale, and said most attacks abuse PHP's session upload-progress path. It expects more exploit paths to appear.

The attackers are also adapting. Cloudflare has seen them tweak their payloads to try to slip past its web application firewall (WAF), apparently using feedback from blocked requests to work out what might get through.

More concerning, some activity began before the flaws were public. Amazon Threat Intelligence says its MadPot honeypot network detected an exploitation attempt on October 17, four days before patches were released. Amazon said it is unclear how the actor obtained exploit information while the flaw was under embargo. On October 21, it saw multiple proof-of-concept exploits, the earliest about 12 hours before the patches landed. Attempts over the following six hours came from different anonymized infrastructure with varied payloads, which Amazon believes points to multiple attackers rather than one group.