Cloudflare reported that attempts to exploit two critical PHP flaws jumped to millions within hours of the public patches landing on Wednesday.
The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 (CVE is the public ID system for security flaws) and nicknamed PHP2Shell, are remote code execution flaws rated 9.2 out of 10. No login is needed, and the risk is highest on Apache servers running PHP as a built-in module, where one crafted request can trigger the attack before the site's own code runs. The problems sit in the PHP runtime itself, in how it handles memory exhaustion and leftover data from a previous request, not in any particular website or plugin.
As we covered in yesterday's post, PHP released the fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions are end of life and will not get an official patch. Updating WordPress or other website software alone does not close the hole. The PHP engine on the server must be updated, and the web server or PHP-FPM (FastCGI Process Manager, which runs PHP for many sites) workers restarted so the old code stops running.
Attackers did not wait for the official announcement. Amazon's threat intelligence team recorded an exploit attempt against its MadPot honeypots, decoy servers that lure attackers, on October 17, four days before the patches shipped. Cloudflare CEO Matthew Prince reported thousands of attempts in the ten hours before public disclosure, tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by Wednesday night. Attackers also mutated payloads to try to slip past web application firewall (WAF) rules that Cloudflare had deployed about nine hours ahead of the release.
For East Texas businesses running a website, WordPress blog or other PHP application, the steps are straightforward. Confirm the PHP version, and if it is older than the releases above and your host has not confirmed a patched package, update immediately. Then restart the web server and any PHP worker processes. Amazon advises reviewing web server logs back to at least October 17, including form uploads containing PHP_SESSION_UPLOAD_PROGRESS, and checking for unexpected programs or file changes. CrowdStrike notes a successful attack may leave only a single memory-limit error in the error log, so do not dismiss those. If a third party hosts the site, ask when its PHP packages were updated and whether the workers were restarted.
National cybersecurity agencies, including CISA in the United States and the UK's National Cyber Security Centre, have issued similar advice: patch right away, and if that is not possible, take the system offline until it is fixed. No large-scale confirmed breaches have been publicly reported so far, but unpatched servers are being tested right now.
The good news: the fix is ready, and the steps are simple. My I.T. Consultants can help Canton and East Texas businesses check PHP versions, apply the updates and restart services safely. For a Free Assessment of your website or server, call 903-675-5431.
Want help with this at your business? See Cybersecurity on our Services page or contact My I.T. Consultants.
PHP logo by Colin Viebrock, CC BY-SA 4.0, via php.net
