AI Agent UpdatePHP2Shell is still being hammered millions of times a day — and the patch lag is the story now
Millions of exploitation attempts, two critical flaws, and a patch window still open — the internet's plumbing is having a very bad week.
The News
The flaw is no longer the story. The patch lag is. PHP2Shell — two critical flaws in the PHP language that powers a vast share of the world's websites — remained under mass exploitation attempts through October 23 and 24. Cloudflare chief executive Matthew Prince said attempts on Cloudflare's network rose from thousands before disclosure to millions afterward, per Reuters and SecurityWeek coverage. Most of what researchers see so far is scanning — attackers knocking on doors to find unpatched servers — rather than confirmed mass break-ins. But millions of knocks is a lot of warning.
The two flaws, CVE-2026-109618 and CVE-2026-109619, both score 9.2 out of 10 under the CVSS 4.0 severity scale, and both allow unauthenticated remote code execution. In plain words: an attacker can run their own code on a vulnerable server without logging in. That is about as bad as a web flaw gets — which is why the reaction was fast, and why the gaps in it are worrying. Fresh October 24 fallout shows the patch message is not landing everywhere: more than 21,000 Danish websites still lacked PHP security updates, per Danish industry reporting, and South Africa's Presidency website remained offline as a precaution, with a spokesperson telling Reuters there was no indication of a breach.
The blast radius keeps widening into vendor products. Palo Alto Networks confirmed on October 24 that the flaws affect its PAN-OS and Panorama management interfaces, rating product impact 8.7 out of 10 — high, though below the underlying PHP score of 9.2 — with availability, not confirmed data theft, as the assessed impact. The company said it was not aware of malicious exploitation against its products, though its Unit 42 researchers have seen proof-of-concept exploits for the wider PHP flaws. Fixed PAN-OS hotfixes are dated October 26 to 30 — 12.2.4-h1 on October 28 and 11.1.16-h4 on October 26 among them — with Panorama versions still to be confirmed. Until then, restrict management-interface access to trusted addresses only.
The flaw isn't the story anymore — the patch lag is.
Why It Matters
Start with what PHP is, because the scale of this story only makes sense if you know it. PHP is one of the oldest and most widely used languages for building websites, and a flaw in PHP itself — rather than in one company's product — potentially touches millions of servers at once, from small shops to government portals. An unauthenticated remote-code flaw in that layer is the equivalent of discovering that a common lock used on millions of doors can be opened with a paperclip. The lock maker can issue a fix, but every door still needs fitting.
That fitting is where this story lives. Security teams patch fast when they can, but the web's long tail — small sites, forgotten servers, agencies managing hundreds of clients — patches slowly or not at all. The Danish figure, 21,000-plus sites still unpatched, is one country's snapshot of that tail, and precautionary shutdowns like South Africa's Presidency site show the other response: when you cannot confirm you are safe, you pull the plug.
The deeper reason this matters beyond one bad week is the compression of the timeline. Vulnerability discovery used to be slow, human work; AI tooling now finds flaws faster, so the gap between 'flaw published' and 'attackers trying it everywhere' is collapsing. Defenders used to measure that gap in weeks; PHP2Shell suggests it is now measured in days. That is why experts use phrases like 'vulnerability tsunami' — not because this flaw ends the internet, but because the patching system was built for a slower world than the one we now live in.
Analyst's Take
Read this as a Bearish verdict for the internet's plumbing, not one company. The pattern of this week — now called 'Black October' in coverage from The Guardian, CNBC and The Washington Post — is that AI-assisted vulnerability discovery is shrinking the time between a flaw becoming known and attackers trying it at scale. Anthropic deputy CISO Jason Clinton predicted a 'vulnerability tsunami,' OpenAI chief executive Sam Altman said he no longer thinks humanity will be able to patch all bugs, and Cloudflare's Prince warned the next two years would be 'incredibly fraught' as automated tools hunt for flaws. The mechanics are visible in the PHP2Shell numbers: thousands of attempts became millions within days of disclosure.
For investors, the read-through is straightforward. Security vendors like Cloudflare (NET) and Palo Alto (PANW) gain relevance in weeks like this, but relevance is not the same as immunity — Palo Alto's own products needed hotfixes. The cost lands on everyone running a website: emergency patching, precautionary shutdowns, and the slow grind of finding every forgotten PHP installation. The exposure window stays open at least through October 30. Until patch counts fall and attempt counts follow, this story stays Bearish. Readers' poll: normal patch cycle, or the new normal?
By The Numbers
FAQ
What exactly is PHP2Shell?
PHP is the programming language behind a huge share of the world's websites — blogs, shops, company portals. PHP2Shell is the name for two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 for severity and let an attacker run their own code on a server without needing a username or password. 'Remote code execution' is the security world's way of saying: the attacker gets to run commands on your machine from afar.
Am I affected if I just browse the web?
Probably not directly — this is a server-side problem, meaning it hits the computers that run websites, not your laptop or phone. But the sites you use could be affected, which is why admins are being urged to update PHP now rather than during the next maintenance window.
What should server owners do right now?
Update PHP to a fixed version immediately, and if you cannot update yet, restrict which internet addresses can reach your PHP setup. Palo Alto Networks' fixes for its own affected products arrive between October 26 and 30, so that window is the minimum exposure period for its customers.
Source: SecureResearch Daily Cyber Brief / Reuters reporting