Technology and Scienceupdated 1h ago2 min read
Cloudflare CEO Matthew Prince Says Hackers Launch Millions of PHP Exploit Attempts
This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Millions of exploit attempts occurred in the 10 hours before PHP2Shell vulnerabilities were publicly disclosed. Attempts originated from commercial anonymization networks' IP addresses, prompting Cloudflare to deploy protections.
Save coverage image
Where the coverage agrees
Explore source coverage 3 source types
Directory totals describe our source library, not outlets checked for this story.
18 outlets told this the same way.
Outlets did split on Marco Rubio Says Elon Musk Controls Ukraine Starlink And Starshield Access →
PHP2Shell hits at scale
Cloudflare CEO Matthew Prince said the company saw “millions” of exploit attempts after two critical PHP vulnerabilities were publicly revealed. Prince said Cloudflare observed “thousands of attempts to exploit” in the 10 hours before the public announcement, then saw the figure jump to “tens of thousands in the 45 minutes after the announcement” and “millions now.”
The US National Security Agency warned the PHP flaw could allow “attackers to take control of web servers, steal data and disrupt services,” prompting governments and companies to pull websites offline to patch. The BBC’s Traitors website was down on Thursday as governments and companies rushed to protect systems running PHP.
Early probing before disclosure
Amazon Threat Intelligence said it detected an attempt to exploit PHP2Shell vulnerabilities on October 17, 2026, targeting its MadPot honeypot service. CJ Moses, CISO of Amazon Integrated Security, said the attempt “originated from an IP address associated with a commercial anonymization network,” and he added that the targeting of a honeypot from an anonymized IP address “suggests the activity was conducted by a threat actor.”
The attempt was recorded from “103.216.220[.]92,” an IP address geolocated to Australia. The PHP Foundation moved the release forward by one day after details about the CVE identifiers and a proof-of-concept leaked ahead of time.
Patch race and shutdowns
The FBI’s Cyber Division warned that the PHP vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” urging organizations to either adopt an immediate update or take affected systems offline. The US Cybersecurity and Infrastructure Security Agency advised organizations to disconnect PHP-based systems if an immediate update was not possible, saying “organizations are advised to disconnect the system until the vulnerability can be fully mitigated.”
Emergency shutdowns of banking, air, railway, tax, and government services stretched “from Tokyo to Helsinki,” as governments disconnected websites as a precaution on Wednesday. Satya Nadella told an event in Cologne, Germany, “It has been a long day and a long night, I know, for all the IT and security teams… It’s been a very, very long time since I’ve seen anything like this.”
