Cloudflare CEO Matthew Prince has shared a striking, real-time snapshot of just how fast attackers moved to exploit the critical PHP vulnerabilities disclosed on October 21, 2026 — now widely nicknamed “php2shell” — with exploit attempts across Cloudflare’s network escalating from thousands to millions within a matter of hours.
“Some stats on #php2shell,” Prince wrote on X. “In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
What the numbers show
The progression Prince described maps almost exactly onto the disclosure timeline itself. In the 10 hours before the vulnerabilities were publicly announced, thousands of exploit attempts were already hitting Cloudflare’s network — a reminder that even a narrow leak of technical details, which happened in the days before PHP’s official release, is enough for attackers to start probing. Within 45 minutes of the public announcement, that number had jumped roughly tenfold to tens of thousands of attempts; within two hours it had climbed into the hundreds of thousands; and by the time Prince posted his update the next morning, attempts had reached into the millions.
The vulnerabilities in question — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS scale — allow unauthenticated remote code execution on servers running PHP, the language that still underpins a large share of the web. PHP’s maintainers pushed out emergency patches (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35) on October 21 after a leak forced them to move up the planned release by nearly a day.
Why the speed matters
Cloudflare’s numbers offer one of the clearest public illustrations yet of how compressed the window between vulnerability disclosure and mass exploitation has become. Security researchers had already warned that this particular disclosure was unusually fragile: CVE identifiers and a rough description of the bugs leaked onto forums and social media two days before the planned release, a security firm investigating the flaws mistakenly published a proof-of-concept demo video, and a container-image provider broke the coordinated embargo by publishing patched images hours ahead of the agreed release time — handing anyone willing to study the fix a head start on building a working exploit.
For organizations still running unpatched PHP installations, the practical takeaway is clear: the gap between “a patch exists” and “attackers are actively trying it against every exposed server they can find” is now measured in minutes, not days.