Cloudflare Reports Millions of PHP2Shell Attack Attempts: What Website Owners Need to Know
October 25, 2026 | Cybersecurity & Website Security
A major cybersecurity incident has put websites running PHP under renewed scrutiny after the disclosure of two critical vulnerabilities known as PHP2Shell. Cloudflare reported a rapid increase in attempts to exploit these weaknesses, with activity climbing from thousands of attempts before public disclosure to millions afterward.
The vulnerabilities raised serious concerns because PHP powers a substantial portion of the web, including popular content management systems, online stores, and custom business applications. Successful exploitation of vulnerable systems could potentially allow attackers to execute malicious code, expose sensitive information, or disrupt website operations.
Cloudflare says it deployed Web Application Firewall (WAF) protections for the known PHP2Shell attack patterns before public disclosure. However, the company also emphasised that website owners must still patch their PHP installations.
This article examines what Cloudflare reported, what the PHP vulnerabilities mean, how attackers attempted to exploit them, and what businesses should do to protect their websites.
What Did Cloudflare Report?
In its October 21, 2026 security article, Cloudflare explained that it had worked with security researchers and other organisations to develop protections against the PHP2Shell vulnerabilities.
Cloudflare said its WAF protections had been deployed approximately nine hours before public disclosure. The company reported that customers using its Free or paid WAF were protected by default against the known PHP2Shell attack patterns from October 21.
Cloudflare's CEO subsequently described the increase in attempted exploitation across the company's network:
Thousands of attempts were observed during the ten hours before public disclosure.
The number increased to tens of thousands within 45 minutes of disclosure.
Attempts reached hundreds of thousands within approximately two hours.
Cloudflare subsequently reported millions of attempts.
These figures describe observed attempts across Cloudflare's network, not millions of confirmed successful website compromises.
An attack attempt may be blocked by a WAF, fail to trigger the vulnerability, or target a system that is not vulnerable. The number of requests therefore cannot be treated as a count of hacked websites.
Source: Cloudflare's official PHP2Shell security report.
What Is PHP2Shell?
PHP2Shell is the name associated with two critical vulnerabilities in the PHP runtime:
CVE-2026-109618
CVE-2026-109619
PHP is a server-side programming language used to process requests, interact with databases, and generate dynamic website content.
The reported vulnerabilities involve unsafe handling of internal memory and request state. Under affected conditions, specially crafted HTTP traffic could trigger errors that potentially lead to remote code execution or other serious security consequences.
Remote code execution, or RCE, means an attacker may be able to run unauthorised code on a vulnerable system from a remote location.
This is especially concerning when the affected service is publicly accessible and runs with permissions that provide access to application files, credentials, or other sensitive resources.
The vulnerabilities affect the PHP runtime itself. Updating a website's design, changing its theme, or updating an unrelated plugin does not replace the need to patch the underlying PHP installation.
Technical details and remediation guidance are available from the official Cloudflare report and the PHP security release archive.
How Did Attackers Attempt to Exploit Vulnerable Websites?
The reported attack activity involved specially crafted HTTP requests intended to trigger the vulnerabilities.
A simplified explanation of the risk is:
An attacker identifies a publicly accessible service running a vulnerable PHP version.
The attacker sends a request designed to trigger unsafe PHP memory or request-state handling.
If the exploit succeeds, the attacker may gain the ability to execute code or access information available to the affected process.
Depending on the system's permissions and configuration, the attacker may attempt further actions against the website or server.
Potential consequences include unauthorised file changes, exposure of sensitive data, website disruption, and attempts to establish persistent access.
These are potential outcomes of successful exploitation, not proof that every targeted website suffered a breach.
Amazon reported observing PHP2Shell probing as early as October 17, before the vulnerabilities were publicly disclosed. Security reporting subsequently described a sharp increase in attempts following disclosure and the release of patches.
This timeline shows why organisations should investigate suspicious activity that occurred before the public announcement, rather than reviewing only events recorded after the patches became available.
Source: Reuters — Hacking attempts surge as companies and governments rush to patch PHP flaws.
How Did Cloudflare Protect Websites?
Cloudflare operates as an intermediary between visitors and an origin server when a website is correctly configured to use its services.
Its Web Application Firewall inspects web requests and applies security rules to identify and block recognised malicious activity.
For PHP2Shell, Cloudflare developed protections specifically designed to detect exploitation attempts. Its article also describes a more advanced detection approach that considers information from both the incoming request and the origin server's response.
This matters because request data alone may not always be sufficient to determine whether a particular exploit has succeeded. Additional transaction context can help distinguish malicious activity from legitimate traffic and reduce false positives.
Cloudflare stated that its PHP2Shell protections were available on all plans with WAF deployed, including Free customers.
However, this statement should be understood in context. It concerns the documented PHP2Shell protections and known exploit patterns, not a guarantee against every possible cyberattack.
Cloudflare's protection also depends on the website's actual configuration and the applicable rules. Website owners should verify that the relevant traffic passes through Cloudflare and that their security settings have not been weakened or bypassed.
Does Cloudflare Mean Your Website Cannot Be Hacked?
No. Cloudflare can substantially strengthen a website's defences, but it does not make a website completely immune to cyberattacks.
A WAF is an additional layer of security. It cannot replace operating-system updates, PHP patches, secure application development, appropriate access permissions, or incident monitoring.
There are several reasons why a website may remain at risk:
Unpatched software: A vulnerable PHP installation can remain exposed even when additional security controls are in place.
Direct access to the origin server: If attackers can reach the origin directly, they may bypass security controls that normally inspect traffic through Cloudflare.
Other vulnerabilities: A website may contain unrelated weaknesses in its application code, plugins, authentication, or server configuration.
Compromised credentials: A stolen administrator password or exposed API key may provide access through legitimate authentication rather than through the PHP2Shell vulnerability.
Existing compromise: Applying a security rule does not automatically remove malicious files or an attacker's previously established access.
Businesses should therefore use Cloudflare as part of a broader security strategy rather than relying on it as their only line of defence.
Emergency PHP Patches: What Should Website Owners Do?
The PHP project published security releases on October 21, 2026, addressing CVE-2026-109618 and CVE-2026-109619.
The corresponding fixed releases were:
PHP branch | Fixed release |
|---|---|
PHP 8.5 | 8.5.12 |
PHP 8.4 | 8.4.27 |
PHP 8.3 | 8.3.36 |
PHP 8.2 | 8.2.35 |
Website owners should verify their installed version and upgrade to the latest appropriate supported security release. Hosting providers may also supply backported fixes, so administrators should confirm the actual patch status with their provider.
Additional information was published on October 23 concerning CVE-2026-115560, a related vulnerability involving PHP's session upload progress feature. Cloudflare's follow-up guidance states that its protection for known exploit attempts depends on the default upload progress field name; sites that have changed session.upload_progress.name are not covered by that particular WAF rule.
This later development reinforces the importance of monitoring official advisories instead of assuming that one security update or firewall rule resolves every related issue.
For current instructions, consult the PHP security archive and Cloudflare's security article.
Website Security Checklist for Businesses
Organisations should take the following steps to reduce their exposure.
1. Identify PHP installations
Check websites, hosting accounts, containers, APIs, and third-party applications that run PHP. Include systems managed by hosting providers or other vendors.
2. Install the appropriate patches
Upgrade affected installations to the relevant fixed release or verify that the vendor has applied an equivalent security fix. If an exposed system cannot be patched promptly, follow official mitigation advice and consider restricting access until the risk is addressed.
3. Verify Cloudflare protection
Confirm that the domain uses the intended Cloudflare configuration, the relevant WAF protections are enabled, and traffic reaches the origin through the expected security controls.
4. Restrict direct origin access
Where appropriate, configure the origin server to accept web traffic only from trusted Cloudflare infrastructure or another approved access path. Test the configuration carefully to avoid disrupting legitimate services.
5. Review security logs
Look for suspicious requests, unexpected file changes, unusual processes, unfamiliar accounts, and unexpected outbound connections. Compare Cloudflare events with origin-server and application logs.
6. Investigate possible compromise
If there is evidence that an attacker gained access, do not assume that patching alone resolves the incident. Preserve logs, contain the affected system, investigate the scope of access, and rotate credentials or secrets that may have been exposed.
7. Maintain an ongoing patching process
Track software versions, monitor security advisories, assign responsibility for updates, and establish a process for deploying emergency fixes. Keep tested backups and ensure that restoration procedures are available.
What This Incident Means for Website Owners
The PHP2Shell incident demonstrates how quickly a critical software vulnerability can attract widespread attention and exploitation attempts.
Cloudflare's reporting shows the value of having protective controls in place before a vulnerability becomes public. Its WAF protections provided an additional defence against known PHP2Shell exploit attempts while organisations worked to update their systems.
At the same time, the incident highlights the difference between blocking malicious traffic and fixing the underlying software.
Businesses should not wait for evidence of a successful attack before taking a critical vulnerability seriously. They should identify affected systems, patch them promptly, review protective controls, and investigate suspicious activity.
The most reliable approach combines updated software, carefully configured infrastructure, restricted access, monitoring, backups, and a tested incident-response plan.
Final Thoughts
Cloudflare reported millions of PHP2Shell exploitation attempts across its network after the disclosure of critical PHP vulnerabilities in October 2026. The company also described how its WAF protections were deployed ahead of public disclosure to help defend customers against known exploit patterns.
These reports do not mean that millions of websites were successfully hacked. They demonstrate the scale and speed of attempted exploitation against a widely used software component.
For businesses, the message is straightforward: use Cloudflare and other appropriate security controls, but do not rely on a firewall as a substitute for patching and proper server maintenance.
At Zarrar Innovations, we believe that website security is an essential part of building reliable digital products. Secure software, responsible maintenance, and well-configured infrastructure help businesses protect their services and maintain customer trust.
Need help with your website or digital infrastructure?
Visit https://zarrarinnovations.com or contact info@zarrarinnovations.com.
Sources and Further Reading
Editorial note: Attack-attempt figures refer to reported network activity, not confirmed successful compromises. Readers should consult the latest official advisories for current patch and mitigation instructions.
Written by
Zarrar Innovations
