SecurityDeveloping

Confirmed PHP compromises reported as fallout grows over early flaw disclosure

Cloudflare logs millions of exploit attempts; OpenAI warns more AI-found bugs are coming

By LineZotpaper AI staff

Published24 October 2026

Updated26 October 2026

Read Time3 min

Sources4 outlets

Reactions2 on X

Follow this storyHear when it moves

Illustration: Confirmed PHP compromises reported as fallout grows over early flaw disclosure

Security vendors reported confirmed compromises and post-exploit activity tied to the PHP vulnerabilities known as PHP2Shell by late Friday, as fallout from this week's early disclosure continued. Cloudflare said it had seen "millions" of exploit attempts, Amazon's cloud division said the flaw was "now being broadly exploited in the wild," and cyber agencies across Europe, the US, the UK, Australia and Canada urged organisations to patch.

What we know so far

Updated 26 Oct, 1:31 UTC

PHP released patches on 21 October 2026 for two critical flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed php2shell), which are rated 9.2 and allow unauthenticated remote code execution. (InfoQ)
Amazon Threat Intelligence says it found an exploitation attempt dating to 17 October in its MadPot telemetry, four days before the patches existed. (InfoQ)
NewThe PHP advisories say remote code execution is confirmed on Apache mod_php, while for PHP-FPM only the session lifecycle case has been validated, and no complete exploit for the out-of-memory bug has been demonstrated; FrankenPHP is described as likely susceptible based on source analysis alone. (InfoQ)
NewChainguard CEO Dan Lorenc released details of the flaw before the agreed embargo ended, and he apologised on LinkedIn; Lorenc says the flaw was already being exploited, a claim others have disputed. (All Content from Business Insider)
Cyber agencies in Europe, the US, the UK, Australia and Canada issued urgent warnings, and numerous governments took websites offline as a precaution; no major hacking damage was immediately apparent, according to POLITICO. (All Content from Business Insider)

How it unfolded

17 OctAn exploitation attempt against the PHP flaws is recorded in Amazon's MadPot telemetry. (InfoQ)
21 OctThe PHP Foundation publicly releases patches fixing the two flaws. (InfoQ)
21 OctChainguard's Dan Lorenc publicly releases information about the flaw ahead of the coordinated embargo. (All Content from Business Insider)
21 OctCyber agencies in Europe, the US, the UK, Australia and Canada post urgent warnings about the flaws. (All Content from Business Insider)
22 OctIn an interview with POLITICO, Lorenc says the flaw was already being exploited when he released the information. (All Content from Business Insider)

Security vendors Palo Alto Networks and Trail of Bits confirmed compromises and post-exploit activity related to the PHP bug as of late Friday, according to TechCrunch. While no major hacking damage was immediately apparent in the first 72 hours, researchers warned that many systems remain unpatched and vulnerable to hacks and data theft.

The flaws, officially designated CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, allow remote, unauthenticated access to systems running PHP, a programming language estimated to sit behind around 70% of the web-facing internet. An attacker could take full control of an affected server, plant malware or steal data. The bugs were first found in 2024 but were not considered exploitable until researchers at Calif recently worked out how to use them.

Calif discovered the bugs as part of a security audit, working under the Hack the Planet initiative from OpenAI and cloud security company Wiz, which verified the proof-of-concept exploits. The researchers said AI was used as an aid in exploiting the bug, but the bulk of the work relied on knowledge they already had. "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now," they wrote.

The PHP Foundation released patches on Wednesday after giving major internet companies and web hosts an early headstart under embargo. The coordinated disclosure process unravelled when Chainguard released information early. CEO Dan Lorenc apologised in a LinkedIn post, but told POLITICO on Thursday he had shared the details because the flaw was already being exploited, a claim others disputed. He called the evidential threshold in coordinated cyber defence a "grey area."

The PHP Foundation said Chainguard "unilaterally broke the embargo," disregarding "weeks of work by many parties toward a coordinated disclosure." Executive director Elizabeth Barron said the foundation was "disappointed" but hopes to "rebuild trust with them in the future." Amazon said it detected exploitation about a week before patches were available, as early as October 17, though it was not clear how attackers learned of the bugs.

Governments across Europe, the US, the UK, Australia and Canada issued urgent warnings, and banks, retailers, hospitals, gaming sites and some government agencies took services offline. Cloudflare CEO Matthew Prince said on X that the company saw thousands of exploit attempts in the 10 hours before the public announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, and "millions" since. Amazon's cloud division said the flaw was now being broadly exploited in the wild.

The episode has sharpened warnings about AI-driven cyber risk. OpenAI said: "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months." Cyber agency officials in the Netherlands and Germany said AI had made such events likely and forced more drastic defensive measures, including taking websites offline. A senior US government cyber official said federal authorities were also dealing the same day with bugs in node.js, Fortinet, GitHub and Oracle, comparing the workload to a fire department fighting multiple fires at once. Agencies are now urging organisations to install the PHP Foundation patch.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

How it's landing

Unit 42 @Unit42_Intel

2/2 This led us to believe that it was exploitation of those vulnerabilities. We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23.

25 Oct, 21:53 UTC View on X

MalwareTech @MalwareTechBlog

Cybersecurity researcher

Since people are yelling at threat intelligence professional for "downplaying the severity of the PHP vulnerability" (communicating clear concise information about what they're actually seeing). It feels necessary to explain what threat intelligence actually is. Consider a hypothetical hospital or a power company. A lot of systems are built using very old PHP versions. It's not uncommon for PHP to add/remove/change features from version to version. So if you're a certain number of versions behind, updating to the latest version will break your software by removing or changing functionality it needs. In that case, the provider has two options: 1) take their software offline until they can update the code to match the latest PHP version. 2) panic install the patch and break their software, leading to a massive outage. In both cases, that is basically a 100% chance of an outage. On the other hand, maybe they get hacked, maybe they don't. Maybe that hack causes an outage, maybe it doesn't. Realistically, under these circumstances, the chance of an outage is actually higher with patching than with not patching. If that outage would result in the hospital having to shut its doors or a power company's infrastructure going offline, what is the correct move? Chance being hacked, or knowingly cause an outage that threatens lives? Cybersecurity is important and all, but there are risks far greater than being hacked. I would absolutely love it if I could just log onto IDontKnowWhyTheyRenamedThisSite dot Com, be like "vulnerability bad, pls patch" and everyone installs the patch. That is not the world we live in. Now, if I start seeing people building ransomware that can copy itself from system to system using the PHP vulnerability, and I communicate that, it changes a lot of people's risk calculations. Their option shift towards either a 100% chance of an outage, or an extremely high chance of an outage + catastrophic data loss. In this case they would most likely pull the trigger on patching or taking their software offline. While the hypotheticals I gave are extreme cases, many organizations accept being hacked as a cost of doing business. Taking offline software that's critical to business function is a very serious decision that doesn't get taken likely. We don't live in LaLa land where every org installs every patch for every vulnerability the day it goes live. Cybersecurity is expensive and costs serious money. Getting people to even patch systems at all is an endless uphill battle. Most orgs know that something like 1 out of ever 10,000 critical vulnerabilities gets exploited. And probably less than 50% of these "this is the worst of the worst, the sky is falling" type vulnerabilities leads to mass-exploitation. It takes a lot of time to build trust, and very little time to lose it. Overhype a couple of vulnerabilities and people will very quickly stop listening to you. It's very easy to end up being the boy who cried wolf. There's only so many times you can spin security teams into a frenzy. Orgs also have limited resources, so when you yell fire, there is a good chance they're committing resources they don't have. Making people stay up all night, pulling people off other issues. You probably don't want to be responsible for some org getting ransomwared because they redirected all their security resources to some vulnerability you think is really cool. Nobody is downplaying anything. They are communicating exactly what they see/know so that organizations can make their most informed decisions possible. That is the game, and that is what threat intelligence exists for. If you want to handle an organization's security for them and take on the risk of killing their customers personally, join an MSSP or a critical infrastructure provider. It's not our job to decide organization's own risk models for them. It's our job to give the most information possible to the people who do. And just because some vulnerability researcher thinks we're not hyping up the vulnerability enough doesn't make them right. Last I checked, only something like 9.3 million out of 42 million systems had installed the patch. This is the reality we live in. If we yell fire, then maybe we can bump that number up to 10 million, but if nothing happens, it'll be at the cost of maybe 2 million less systems getting patched next time around. These are real risks we have to live with. These aren't one-off incidents. People will remember how accurate our advice was the next time around. And more or less people may decide to install security fixes based on how accurately we communicated the risks during previous incidents. Threat intelligence is an extremely complex numbers game where there is never any right answer.

24 Oct, 18:18 UTC View on X

Posts on X from people the desk follows. Their words, unedited.

Analysis

Why This Matters

Roughly 70% of the web-facing internet runs on PHP, so unpatched systems remain exposed to unauthenticated remote code execution that could let attackers take full control of a server.
The breakdown of coordinated disclosure forced mass website shutdowns and shows how a single early release can amplify a vulnerability crisis.
OpenAI says similar AI-assisted vulnerability findings are likely to increase sharply in coming months, making this week a possible preview of a new pattern.

Background

PHP is an open-source programming language used to build websites and web apps, including WordPress, Drupal, Joomla and MediaWiki. The two PHP2Shell flaws were first identified in 2024 but were not considered exploitable until researchers at Calif found a way to exploit them this year. Because they can be used remotely without credentials, they rank among the more damaging classes of vulnerabilities.

The PHP Foundation coordinated a fix under embargo, giving large companies early access to patches before Wednesday's public release. Coordinated disclosure is meant to ensure a fix is available before details of a flaw become public. In this case, details circulated early and Chainguard released information before the embargo ended, setting off a scramble among governments and companies.

Key Perspectives

Chainguard CEO Dan Lorenc: shared details early because he believed the flaw was already being exploited, which he said invalidated the embargo; he called the evidential threshold a "grey area." PHP Foundation: says Chainguard "unilaterally broke the embargo" and disregarded weeks of coordinated work; executive director Elizabeth Barron said the foundation was "disappointed" but hopes to rebuild trust. Cloudflare CEO Matthew Prince: reported "millions" of exploit attempts, with numbers rising sharply after the public announcement. Amazon's cloud division: said the flaw was "now being broadly exploited in the wild." Palo Alto Networks and Trail of Bits: confirmed compromises and post-exploit activity related to the bug as of late Friday. OpenAI: says the PHP bugs are among several significant vulnerabilities it has found and expects similar findings to increase sharply in coming months.

What to Watch

Whether confirmed compromises grow as researchers warn that a large number of systems remain unpatched.
Whether the dispute between Chainguard and the PHP Foundation changes how future coordinated disclosures are handled.
The pace of new AI-assisted vulnerability discoveries, including the node.js, Fortinet, GitHub and Oracle bugs agencies were tracking the same day.

Sources

PHP Patches Two Critical RCE Flaws That Were Already Under Attack · InfoQ
Inside the cyber flaw scramble that brought the AI threat to life · Politico Europe
Inside the cyber flaw scramble that brought the AI threat to life · Business Insider
PHP-ocalypse: How two critical web bugs almost broke the internet · TechCrunch

Checked

12 claims in this story checked against 2 sources: 10 supported.

Show each claim

SupportedConfirmed compromises and post-exploit activity related to the PHP bug were reported by late Friday.TechCrunch: “But as of late Friday, there are now confirmed compromises and post-exploit activity related to the PHP bug, according to security giants Palo Alto Networks and Trail of Bits.”
Partly supportedCloudflare “logs” millions of exploit attempts.All Content from Business Insider: “Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.”
SupportedOpenAI said it expects similar vulnerability findings to increase sharply in the coming months.All Content from Business Insider: ““These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company said Wednesday in a statement.”
Partly supportedGovernments across Europe, the US, the UK, Australia and Canada issued urgent warnings.All Content from Business Insider: “The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday.”
SupportedCloudflare’s Matthew Prince said the company saw “millions” of exploit attempts.All Content from Business Insider: “Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.”
SupportedAmazon’s cloud division said the flaw was “now being broadly exploited in the wild.”All Content from Business Insider: “Amazon's cloud division also said the flaw is “now being broadly exploited in the wild.””
SupportedCalif’s researchers wrote, “No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now.”TechCrunch: ““No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,”wrote Calif.”
SupportedLorenc said he shared the information early because the flaw was already being exploited, and others disputed that claim.All Content from Business Insider: “But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.”
SupportedLorenc described the evidential threshold in coordinated cyber defence as a “grey area.”All Content from Business Insider: “While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a “grey area.””
SupportedThe PHP Foundation said Chainguard “unilaterally broke the embargo,” disregarding “weeks of work by many parties toward a coordinated disclosure.”All Content from Business Insider: “Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.””
SupportedAmazon said it detected exploitation about a week before patches were available, as early as October 17, and it was unclear how attackers learned of the bugs.TechCrunch: “Amazon, which has enormous visibility into online threats due to its size and scale, said in a blog post that it detected exploitation of PHP2Shell about a week before the PHP patches were available, suggesting that someone, somewhere, knew how to exploit the bugs before their details were broadly available. Amazon said it wasn’t clear how the hacker learned of the vulnerabilities, but that defenders should look for evidence of exploitation as early as October 17.”
SupportedA senior US government cyber official compared the workload to a fire department fighting multiple fires at once.All Content from Business Insider: ““The fire department is fighting multiple fires at once,” the official said, adding: “The good news is they’re all one-story structures on fire, which the fire department deals with all day, every day.””