Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure

When the PHP2Shell bugs hit the headlines this week, the numbers that poured out of Cloudflare and Amazon were enough to make any founder’s blood run cold. We’re talking millions of exploit attempts hammering servers in a matter of hours, and the scary part is that the attack train started rolling before the patches were even on the table. For anyone running real hosting infrastructure, this isn’t just another “patch‑your‑PHP” memo – it’s a wake‑up call that the whole “wait for the vendor, then patch” playbook is a liability.

Scale of the onslaught: from thousands to millions in minutes

Cloudflare’s own telemetry painted a brutal picture. In the ten hours before the vulnerabilities were publicly disclosed, the company logged “thousands” of exploitation attempts. That sounds like a nuisance, until you watch the curve spike: within 45 minutes of the disclosure, the attempts leapt into “tens of thousands”, then surged to “hundreds of thousands” in the next two hours, and have now climbed into the “millions”. Those are raw hit counts, not unique IPs, and they’re coming from both free and paid plans – meaning even the smallest sites on Cloudflare’s network are being pounded.

Amazon’s threat intel added another layer of dread. Their honeypot network, MadPot, caught an exploitation attempt on October 17 – a full four days before any patch was released. By the time the public learned about the bugs on October 21, Amazon saw multiple proof‑of‑concept attacks, the earliest at 0200 UTC, and a flood of varied payloads over the following six hours. The fact that the activity came from “different anonymized infrastructure” suggests a coordinated, multi‑actor effort rather than a lone script kiddie.

Why the PHP runtime matters more than any plugin

The PHP2Shell flaws are not limited to a single CMS or a popular plugin; they strike at the heart of the PHP runtime itself. Both CVE‑2026‑109618 and CVE‑2026‑109619 carry a critical severity rating of 9.2 and affect PHP’s memory handling. In plain English, an unauthenticated attacker can execute arbitrary code on any server running a vulnerable PHP version, regardless of whether you’re on WordPress, Drupal, Joomla, or a custom framework.

This broad attack surface is a nightmare for hosting providers. You can’t simply tell a handful of high‑profile customers to upgrade – you have to assume every single site on your platform is at risk. The “plug‑and‑play” nature of the exploit, especially when attackers are already tweaking payloads to dodge WAFs, means the window between discovery and compromise can be measured in minutes, not days.

The myth of WAFs as a silver bullet

Cloudflare’s response was to roll out WAF rules across its entire service tier, but the company was quick to qualify that move: “these are no substitute for patching.” The reality on the ground is that WAFs can buy you time, but they’re not a panacea. Attackers in this campaign were already “tweaking their payloads” based on feedback from blocked requests, effectively using the WAF as a testing ground to refine their exploits.

For independent hosting operators, this is a stark reminder that relying on a third‑party security layer without a robust patch management process is a false sense of security. You may block the first wave, but the next wave will be a mutated version designed to slip past the same rules. The only reliable defense remains a rapid, coordinated patch rollout.

Supply‑chain noise adds to the chaos

The PHP Foundation’s spat with supply‑chain security vendor Chainguard over premature release of patched builds added another twist to an already messy disclosure timeline. While the Register reported the accusation, the Amazon honeypot data shows that at least one threat actor was already probing the vulnerability on October 17, well before any public discussion about Chainguard’s actions. This overlap of disclosure, vendor disagreement, and active exploitation creates a perfect storm for operators who are already stretched thin.

In practice, this means you can’t afford to sit on the fence waiting for the “official” patch timeline. The moment a vulnerability is under embargo, the risk of leakage is real, and the cost of a delayed patch can be catastrophic. Hosting firms need to treat embargo periods as high‑risk windows and accelerate internal testing and deployment pipelines accordingly.

Business risk: what this means for your bottom line

From a founder’s perspective, the financial impact of a PHP2Shell breach can be severe. An unauthenticated code execution on a shared server can lead to data theft, ransomware deployment, or the hosting of phishing and malware sites – all of which can trigger black‑listing, loss of customer trust, and hefty remediation costs. The fact that attackers were already active before the public disclosure means that the “patch‑after‑disclosure” model is a liability, not a best practice.

Moreover, the scale of the attacks – millions of attempts in a short window – translates into massive bandwidth and CPU consumption. Even if your WAF blocks the traffic, you still absorb the load, potentially degrading service for legitimate customers. That’s an operational risk that directly hits revenue, especially for smaller providers who can’t absorb spikes in traffic without impacting performance.

Actionable steps for independent hosting providers

First, treat any critical PHP vulnerability as a “fire drill.” As soon as a CVE is assigned, even before public disclosure, begin internal testing on a staging environment. If you have a patch management system, prioritize the rollout to all customers within hours, not days.

Second, augment your WAF rules with custom signatures that specifically target the PHP session upload‑progress path, which Hadrian identified as the primary abuse vector. Monitor blocked request logs for patterns of payload mutation – that’s a clear sign attackers are using your defenses as a lab.

Third, implement robust logging and alerting for any anomalous PHP activity. Amazon’s advice to investigate logs back to October 17 is a good baseline; extend that window to at least a week prior to any public disclosure for future incidents.

Finally, diversify your risk mitigation. Don’t rely on a single vendor’s WAF or patch schedule. Keep a backup of your own hardened PHP builds, and consider containerizing PHP applications so you can spin up patched instances quickly without affecting the rest of your stack.

Looking ahead: the lesson for the industry

The PHP2Shell episode underscores a broader truth: hyperscalers and VC‑backed security startups love to sell “best‑practice” playbooks that assume you have infinite resources and a perfect supply chain. In reality, the moment a critical flaw lands, the attackers are already mass‑producing exploits, and the only thing that can keep you afloat is speed and discipline.

For founders running real hosting infrastructure, the mantra is simple – patch fast, monitor constantly, and never treat a WAF as your sole line of defense. The cost of complacency is measured not just in dollars, but in the erosion of customer trust that can take years to rebuild. Stay sharp, stay patched, and keep your servers humming.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (22 October 2026).

By Allan Ali, Global1.News