PHP2Shell draws millions of attempts, but no success observed
The PHP Foundation patched two critical PHP flaws that could enable unauthenticated remote code execution; Cloudflare reported millions of exploit attempts after public disclosure. No successful exploitation has been observed.
The flaws could let someone on the internet run code on a vulnerable PHP server without logging in. The reporting gives no further detail on how the attempts work, so the volume shows intense probing—not confirmed compromise. Several websites went offline as a precaution.
For teams running PHP services, the immediate tension is between exposure to heavy scanning and the availability cost of taking sites offline; the roundup offers no evidence that those outages followed successful attacks. Its other items—certificate trust, AI agents and software supply chains—are separate incidents, not one shared campaign or mechanism.
CVEs in this update
77 CVEs
Across PHP, ruggedcom ape1808 firmware, pan-os, and related packages.