Cloudflare Reports PHP2Shell Attacks: Here’s How to Protect Your Site

The PHP security team posted an advance notice on October 20 saying both vulnerabilities score 9.2 out of 10 on the CVSS v4.0 severity scale. They held back technical details until the release, but said they could ship sooner if details went public or attacks appeared. The flaws allow remote code execution, meaning an attacker could run their own commands on a vulnerable web server. CERT-EU says the scores suggest no login would be needed.

Researchers are tracking the flaws as CVE-2026-109618 and CVE-2026-109619, though PHP's notice names neither. Exactly who is exposed is still partly unclear. Reports claim every version since PHP 5 is affected, but PHP hasn't confirmed that. What is certain is that fixes will only come for the four supported branches, 8.2 through 8.5. Anything older, including 8.1, 7.x and 5.x, is end of life and won't get an official patch. Security company Mallory estimates that about 884,000 websites and servers still run one of these older, unsupported versions. That's more than half of all the sites that publicly show which PHP version they use.

Cloudflare says they're already seeing early attack attempts and have rolled out emergency firewall rules to all customers, though they stress that these are only temporary measures. Other researchers have yet to confirm any attacks, but Sansec warns that widespread exploitation could begin within 15 minutes of the patch becoming public. The threat has already prompted some Dutch organizations, including the country's House of Representatives, to take their websites offline as a precaution.

Meanwhile, a quick fix circulating online that involves changing a single PHP setting may offer a false sense of security. According to a PHP core developer, applying the patch is the only reliable way to protect affected systems.

How to Protect Yourself Until Your Servers Are Patched:

1. Find out where you're exposed. List every website and server running PHP, including copies tucked inside control panels like cPanel and Plesk, vendor apps and containers, and note each one's version. Anything reachable from the public internet goes to the top of your list, and anything on PHP 8.1 or older is your biggest risk because it will never get an official fix. That list tells you which systems need steps 2 through 4 right now.
2. Cut off public access where you can. CERT-EU advises taking internet-facing PHP apps off public networks until a fix is applied. If going fully offline isn't an option, limit who can reach the site with a VPN, an IP allowlist or a login page in front of it.
3. Put the site behind Cloudflare's emergency rules. Cloudflare has deployed firewall rules against the known attack methods for every customer, including the free plan, but they only work if your traffic actually passes through Cloudflare. Set your DNS records to Proxied (the orange cloud icon), check that the WAF managed rules are switched on, and set your server's firewall to accept web traffic only from Cloudflare's IP ranges.
4. Block file-upload requests where you don't need them. Researchers believe the attack arrives through multipart form requests, the type browsers use to upload files. On sites or pages that never accept uploads, a web server or firewall rule that blocks those requests closes that path, though PHP hasn't confirmed how the attack works.
5. Limit the damage if someone gets in. Security firm GMO Flatt advises removing stored passwords and cloud credentials from the server, lowering its privileges, cutting the data kept on it and storing logs somewhere safe.
6. Watch for warning signs, such as PHP processes launching shells or download tools, new files in your web root, unfamiliar cron jobs or new user accounts. If you spot any, isolate the server and keep your logs.
7. Have the update ready to go. When the fix lands at 14:00 UTC, install it on internet-facing servers first, then restart PHP-FPM or your web server. If a hosting company runs your server, ask them now when the fixed build will be live.

Your choice of web host matters most in moments like this. A managed host handles PHP updates, security patches and backups for you, so you aren't scrambling when a flaw like PHP2Shell hits.

[Compare the Best Managed Web Hosting Providers]

For more articles like this, check out our Tech News page!