Millions of PHP2Shell attempts so far, but officials see no break-in

Hackers have made millions of attempts to exploit PHP2Shell since Wednesday’s disclosure, Cloudflare’s chief executive, Matthew Prince, said on X. Officials in Germany, the Netherlands and Japan say they have not seen one succeed.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

— Matthew Prince 🌥 (@eastdakota) October 22, 2026

Cloudflare saw thousands of attempts in the 10 hours before the announcement. That jumped to tens of thousands in the next 45 minutes and hundreds of thousands within two hours, Prince wrote early on Thursday.

Germany’s cyber agency, the BSI, has seen attacks but no successful use of the flaws, its vice-president, Thomas Caspers, told Politico.

“It seems a little bit more complicated than expected to exploit. When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers,” Caspers said.

No confirmed break-ins

The head of the Dutch cyber agency, Matthijs van Amelsfort, told Politico it had no indication the flaw was being actively misused. The US cyber agency CISA said in its alert on Wednesday it had not seen exploitation at the time.

Elizabeth Barron, executive director of the PHP Foundation, told CNBC on Wednesday that it had seen no working exploits. Matt Suiche, a researcher at the security startup Tolmo, told CNBC that his team had built one in less than a day.

“At the moment it doesn’t look like exploitation has taken off or been widespread,” Ryan Austin, the Calif researcher who helped find the flaws, told the Guardian.

Banks and airlines offline

The disruption spread beyond websites across Europe. Japan’s prime minister, Sanae Takaichi, urged site owners on X to install the fix as soon as it came out.

“We have an urgent request for everyone to take action tonight,” Takaichi wrote, in a translation by Business Insider.

Mizuho’s bank and securities arms halted services on Thursday, Bloomberg reported. Shizuoka Bank suspended its website and app, and companies in the MUFG group halted some online services. All Nippon Airways disabled boarding passes in Apple Wallet, saying it had found no evidence of a breach. Japan Airlines, East Japan Railway and Seven-Eleven Japan took some web services down. Chief Cabinet Secretary Minoru Kihara said no attacks exploiting the flaws had been confirmed.

In France, Orange suspended access to some websites and apps while it deployed the patches. In Britain, a government spokesperson said it was working to identify any exposure in its own online services, the BBC reported. South Korea raised its cyber alert level for the private sector, the Guardian said.

Attempts before the patch

The attempts started before the flaws were public. Someone tried to exploit PHP2Shell on 17 October, four days before disclosure, Amazon said. The attempt hit its decoy servers from an anonymised address. CJ Moses, Amazon’s chief information security officer, said it was unclear how the attacker got exploit details during the embargo.

OpenAI, which led the coalition behind the emergency patches, had said that, to its knowledge, AI found the flaws ahead of attackers. Amazon logged more attempts from several actors in the hours before the 14:00 UTC release.

“PHP2Shell is now being broadly exploited in the wild,” Moses wrote.

Analysis was still going on, he said. It was unclear whether any attempt would have worked on real systems. Amazon gave no information on any victims, Bloomberg reported.

A fight over the leak

The disclosure itself is now in dispute. The PHP Foundation has said Chainguard broke the embargo by publishing patched images more than six hours before the release. Chainguard’s chief executive, Dan Lorenc, told The Register his company did not leak. He said it shipped the fixes because people were already being hit, and would not do anything differently.

“It’s coordinated vulnerability disclosure, unless there’s evidence of active exploits in the wild,” Lorenc said.