Amazon says php2shell exploitation began before disclosure as Cloudflare logs millions of attempts

The vulnerabilities carry a severity score of 9.2 out of 10 and can be used for full website takeover. PHP is used to write a significant majority of websites, making coordinated disclosure and patching especially sensitive. The PHP Foundation, working with partners, was preparing a fix, and the patch was due Oct. 21.

On the day the patch was released, Amazon said it found multiple proof-of-concept exploits. The payloads and the anonymization infrastructure used varied, leading Amazon to assess that multiple threat actors were likely involved. The company said it was analyzing the payloads to determine whether they would have worked in real-world attacks.

The disclosure process did not go as planned. Hours before the embargo was to be lifted, security firm Chainguard allegedly published container images containing fixes for the flaws, TechRadar reported. Around the same time, reports emerged that cybercriminals were actively exploiting php2shell. Major government, education and healthcare websites around the world shut down preventively, and the PHP Foundation issued an alert telling administrators to prepare and apply the patch as soon as it became available.

Cloudflare CEO Matthew Prince said in a post on X that the company saw thousands of exploitation attempts in the 10 hours before the patch was announced. That rose to tens of thousands within an hour of disclosure and hundreds of thousands within two hours, he said; the number has since reached millions. Cloudflare also said some threat actors were modifying payloads based on feedback from blocked requests to try to get past web application firewalls.

Not all attempts have translated into successful compromise. Yotam Perkal, director of security research at Pluto Security, said php2shell did not appear trivial to exploit. Reliable code execution requires getting past Address Space Layout Randomization, a memory protection feature that randomizes where code sits in memory, he said, and many public proof-of-concept exploits do not work reliably on real systems. Perkal warned that exploits will improve and that most PHP servers remain unpatched, urging teams to patch and restart PHP workers. He said real-world exploitation so far looked limited compared with the activity before and after release.

Millions of PHP systems remain exposed, according to the report, and experts urged immediate patching of supported versions.