PHP2Shell attack attempts hit millions — and still no confirmed break-in

The internet has spent the last day throwing everything it has at PHP2Shell. Cloudflare CEO Matthew Prince posted on X that his network logged thousands of exploit attempts in the 10 hours before the flaws went public, then tens of thousands in the 45 minutes after. Two hours in, that was hundreds of thousands. Now it's millions.

So far, the attackers are mostly swinging at air. Germany's cyber agency BSI has watched the attacks roll in without seeing a single success, vice-president Thomas Caspers told Politico — he said the flaw is proving "a little bit more complicated than expected to exploit" and that officials had braced for a much faster attacker sprint. The head of the Dutch cyber agency, Matthijs van Amelsfort, told Politico there's no sign of active misuse, and CISA's Wednesday alert said the same. PHP Foundation executive director Elizabeth Barron told CNBC no working exploits had surfaced, while researcher Ryan Austin, who helped find the flaws, told the Guardian that exploitation hasn't taken off.

Not everyone is calm. Tolmo researcher Matt Suiche told CNBC his team built a working exploit in under a day. Amazon said someone tried to hit its decoy servers on 17 October, four days before the embargo lifted, from an anonymised address — and chief information security officer CJ Moses said it's unclear how that attacker got exploit details early. Moses wrote that PHP2Shell is now being broadly exploited in the wild, though Amazon hasn't said whether any attempt would work on real systems, or named a victim.

Japan didn't wait to find out. Prime Minister Sanae Takaichi urged site owners on X to install the fix the moment it dropped. By Thursday, Mizuho's bank and securities arms had halted services, Shizuoka Bank pulled its website and app, MUFG group companies paused some online services, and All Nippon Airways disabled boarding passes in Apple Wallet — while saying it found no evidence of a breach. Japan Airlines, East Japan Railway and Seven-Eleven Japan also took web services offline. Chief Cabinet Secretary Minoru Kihara said no exploiting attacks had been confirmed.

The disruption rippled across Europe and Asia too. France's Orange cut access to some websites and apps while it patched, a UK government spokesperson said it was hunting for exposure in its own services, and South Korea raised its cyber alert level for the private sector.

Even the disclosure itself is now a fight. The PHP Foundation says Chainguard broke the embargo by publishing patched images more than six hours early; Chainguard CEO Dan Lorenc told The Register his company didn't leak and shipped fixes because people were already getting hit, adding he wouldn't do anything differently. His reasoning: "It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild."