Cyber

Millions

Frontier

<p><strong>October 22, 2026, saw millions of hackers attempt to take advantage of two major vulnerabilities in PHP. Governments and businesses had to take down some online systems while expert teams hurried to put in place emergency patches. This shows how little time have now been given to cybersecurity specialists to counter serious vulnerabilities.</strong></p>
<h3 class="wp-block-heading" id="strong-two-9-2-rated-bugs-that-can-hand-over-a-server-strong"><strong>Two 9.2-rated bugs that can hand over a server</strong></h3>
<p>The vulnerabilities, known together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a critical severity score of 9.2 out of 10. On October 21, 2026, PHP <a href="https://www.php.net/archive/2026.php" rel="noopener noreferrer nofollow">released four fixes</a> for versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.</p>
<p>The <a href="https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php" rel="noopener noreferrer nofollow">UK’s NCSC</a> says the bugs can corrupt PHP’s internal memory. Under certain conditions, an attacker could run code without logging in. <a href="https://www.wiz.io/blog/php2shell-php-rce" rel="noopener noreferrer nofollow">Wiz</a> also showed how sensitive data, including passwords and API keys, could leak from memory.</p>
<p>PHP powers 69.3% of websites with an identifiable server-side language, according to <a href="https://w3techs.com/technologies/details/pl-php" rel="noopener noreferrer nofollow">W3Techs</a>. That shows how widespread PHP is, not how many sites were compromised.</p>
<h3 class="wp-block-heading" id="strong-the-window-between-patch-and-exploit-is-closing-strong"><strong>The window between patch and exploit is closing</strong></h3>
<p>Frontier AI helped researchers piece together exploits for vulnerabilities buried in PHP for years. <a href="https://www.cryptopolitan.com/php-fix-14-year-old-bug-day-early-leak/" rel="noopener noreferrer nofollow">Cryptopolitan</a> reported that the patches arrived a day ahead of schedule after technical details leaked.</p>
<p>Signs of the attack were visible before any attacks were reported. On October 17, 2026, four days before the disclosure, <a href="https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/" rel="noopener noreferrer nofollow">AWS</a> identified the attempt in its MadPot honeypot logs. It is not known whether the attack was successful. AWS security chief CJ Moses warned threats could be created in hours or even minutes after the disclosure by attackers using AI.</p>
<h3 class="wp-block-heading" id="strong-thousands-of-probes-became-millions-in-a-day-strong"><strong>Thousands of probes became millions in a day</strong></h3>
<p>Matthew Prince, CEO of Cloudflare, revealed that thousands of attempts were made in the 10 hours leading up to the disclosure on October 21. It did not take more than 45 minutes after that for the attempts to escalate to tens of thousands. In just two hours after that, the attempts crossed the hundreds of thousands mark. And soon after that, there were <a href="https://blog.cloudflare.com/php-vulnerabilities-waf-protection/" rel="noopener noreferrer nofollow">millions of attempts</a> made. These were attempts, not confirmed breaches.</p>
<p><a href="https://blog.cloudflare.com/php-vulnerabilities-waf-protection/" rel="noopener noreferrer nofollow">Cloudflare</a> had already deployed firewall protection, but that was no substitute for patching.</p>
<p>On October 22, <a href="https://www.reuters.com/world/asia-pacific/cloudflare-sees-millions-exploit-attempts-after-php-disclosure-2026-10-22/" rel="noopener noreferrer nofollow">Reuters reported</a> precautionary service suspensions at Nomura, Mitsubishi UFJ, ANA, East Japan Railway and Orange. Government websites also went temporarily offline in Finland, the Netherlands and France.</p>
<div class="wp-block-image">
 <figure class="aligncenter size-large"><img width="1024" height="576" src="https://www.cryptopolitan.com/wp-content/uploads/2026/10/PHP2Shell_-patches-service-suspensions-and-exploit-attempts-1024x576.png" alt="">
  <figcaption><strong>PHP2Shell Attack Timeline: Millions of Exploit Attempts, PHP Patches and AI Spending</strong>
  </figcaption>
 </figure>
</div>
<h3 class="wp-block-heading" id="strong-finding-every-copy-of-php-is-the-hard-part-strong"><strong>Finding every copy of PHP is the hard part</strong></h3>
<p>PHP can hide inside equipment that administrators rarely think to check. The <a href="https://github.com/NCSC-NL/php2shell/blob/main/README.md" rel="noopener noreferrer nofollow">Dutch NCSC’s inventory</a> includes third-party products under review, among them Fortinet offerings. Searchlight Cyber <a href="https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/" rel="noopener noreferrer nofollow">released a scanner</a> to identify vulnerable hosts. It deliberately tests memory exhaustion, so using it requires care.</p>
<p>PHP Foundation executive director Elizabeth Barron <a href="https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/" rel="noopener noreferrer nofollow">told WIRED</a>:</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>To our knowledge, there has been no successful attempt at remote code execution.</p>
</blockquote>
<h3 class="wp-block-heading" id="strong-where-the-security-spend-is-already-heading-strong"><strong>Where the security spend is already heading</strong></h3>
<p><a href="https://www.gartner.com/en/newsroom/press-releases/2026-09-16-gartner-forecasts-worldwide-ai-spending-to-grow-49-point-5-percent-in-2026" rel="noopener noreferrer nofollow">Gartner’s September 16 forecast</a> puts global AI cybersecurity spending at $51.3 billion in 2026 and nearly $86 billion in 2027. It projects $2.7 trillion for worldwide AI spending in 2026.</p>
<p>PHP2Shell was not responsible for that forecasted expenses. Rather, this case is a great illustration of how important it is for firms to be aware of the software they run, to quickly patch vulnerabilities, and to detect threats long before their damaging effect is felt.</p>
<p>If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.</p>

PHP2Shell flaws draw millions of attack attempts as AI speeds exploits

Table of Contents

Cryptopolitan_News

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!