PHP2Shell flaws draw millions of attack attempts as AI speeds exploits

On October 22, 2026, attackers made millions of attempts to exploit two critical PHP vulnerabilities known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10. PHP had released fixes for four versions on October 21; W3Techs data show PHP powers 69.3% of websites with an identifiable server-side language. The UK’s NCSC said the bugs can corrupt PHP’s internal memory and, under certain conditions, let an attacker run code without logging in. Cloudflare CEO Matthew Prince said attempts grew from thousands before disclosure to millions soon after; these were attempts, not confirmed breaches. Precautionary suspensions affected Nomura, Mitsubishi UFJ, ANA, East Japan Railway and Orange, while government sites in Finland, the Netherlands and France went temporarily offline.