Amazon and Cloudflare report PHP2Shell cyberattack attempts as millions of websites race to patch
Cloud tech bosses urging orgs to check on suspicious activity 4 days prior to the patch being released.
Image by Cybernews
Follow us
- Amazon detected PHP2Shell attack attempts on October 17th, before the flaw became public.
- Cloudflare says exploit attempts surged to millions within hours of the public announcement.
- Critical PHP flaws can let hackers run malicious code on vulnerable servers without passwords.
- WordPress-hosted sites are protected, but independently hosted sites should update PHP immediately.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Amazon Web Services (AWS) said it had detected an attempted attack on October 17th against a decoy server, MadPot, designed to attract hackers, before the PHP flaw was made public yesterday.
CJ Moses, CISO of Amazon Integrated Security, said the earliest attempt originated from an IP address associated with a commercial network used to conceal users' identities.
“While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address suggests the activity was conducted by a threat actor,” Moses writes in a blog published on Wednesday.
As per Moses’s blog, Amazon detected further attempts from different sources in the hours before Wednesday’s disclosure, suggesting multiple attackers were involved.
This led Moses to conclude that the exploit – referred to as PHP2Shell – “is now being broadly exploited in the wild.”
PHP2Shell is now being broadly exploited in the wild,warns CJ Moses, CISO of Amazon Integrated Security.
Moses urged organizations to investigate suspicious activity dating back to October 17th rather than assuming attacks began when the flaws became public.
Cloudflare chief executive Matthew Prince also reported a dramatic escalation in attempts to exploit PHP2Shell before the flaw was publicly announced.
He added that this jumped to “tens of thousands in the 45 minutes post announcement,” and “hundreds of thousands within 2 hours, and millions now.”
Which websites were taken offline by PHP2Shell?
The flaws affect PHP, the programming language underpinning about 70% of known websites on the internet.
Both vulnerabilities – CVE-2026-109618 and CVE-2026-109619 – carry critical severity scores of 9.2 out of 10.
They allow remote code execution (RCE), potentially enabling hackers to run malicious software on vulnerable servers without passwords, steal sensitive information, or disrupt services.
The threat prompted precautionary shutdowns of millions of websites on Wednesday. But some of the big ones included:
- Wikipedia: Its operator reported temporarily disabling some systems pending security updates.
- Internet Archive: The online library briefly went offline while addressing the flaw.
- Government websites: Services in several European countries, including the Netherlands and Finland, experienced precautionary outages.
- Weird Gloop: The wiki-hosting provider reported shutting down its web servers for 13 hours, although it says caching kept most page views available.
What has WordPress said about PHP2Shell?
The good news is that Automatic, the company behind WordPress, said websites hosted on its platforms were already protected.
If your site is hosted on Wordpress.com, WordPress VOP, WP Cloud, Pressable, or Tmblr, your site is already protected,WordPress said in a statement issued yesterday.
However, the wider WordPress project urged owners of independently hosted websites to update PHP immediately.
It stressed that no WordPress software update was planned because the vulnerabilities affect PHP itself, rather than WordPress themes or plugins.
Was PHP2Shell discovered by a human or AI?
A human discovered the bug, and not OpenAI, as has been widely reported – although AI did speed the research process up.
Security firm Calif credited researcher LCFR with identifying the flaw and developing a working exploit in August.
However, according to Calif’s exploit report, it was also participating in OpenAI’s “Patch the Planet” initiative, which uses advanced AI models to uncover and help fix security weaknesses.
According to OpenAI, Calif used GPT-5.6 Sol to investigate the flaw. OpenAI’s own researcher subsequently identified additional flaws, helping to establish the full severity of the threat.
The exploit appears to have been leaked or independently discovered, with code circulating online a day before the patch and prompting PHP to say publicly that it was working on a fix.
Where can administrators get PHP security patches?
PHP released an emergency fix on Wednesday for versions 8.2, 8.3, 8.4, and 8.5.
Administrators should install the official updates immediately, while orgs running older versions may need vendor-supplied fixes.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Ubuntu and third-party maintainers are also providing patches or backported protections for older software.
Hosting provider Hosted Power has published an open-source protective extension, but recommends official updates first.
