Key points
- Cloudflare observed millions of exploitation attempts following the public disclosure of the PHP2Shell vulnerability.
- Government cyber agencies in Germany, the Netherlands, and Japan stated they have seen no evidence of successful breaches.
- Major Japanese organizations, including banks and airlines, temporarily suspended online services as a precautionary measure.
The short version
- Attackers launched millions of attempts to exploit the PHP2Shell flaw after its disclosure on Wednesday.
- Officials in Germany, the Netherlands, and Japan report that no successful intrusions have been confirmed.
- Several major Japanese institutions halted web services to protect systems, though no data theft has been verified.
The details
Cloudflare chief executive Matthew Prince reported that exploit attempts surged dramatically after the vulnerability was made public. According to The Next Web, the network saw thousands of attempts in the ten hours preceding the announcement. That volume jumped to tens of thousands within forty-five minutes of the disclosure. By two hours after the announcement, the count reached hundreds of thousands, eventually climbing into the millions.
Government agencies across multiple countries have monitored the situation closely. Thomas Caspers, vice-president of Germany’s BSI, told Politico that while they observed attacks, none resulted in successful exploitation. He noted that the flaw appears more difficult to exploit than initially anticipated during the patch planning process. The head of the Dutch cyber agency, Matthijs van Amelsfort, also told Politico that his agency had no indication of active misuse.
In Japan, the response involved significant operational disruption. Prime Minister Sanae Takaichi urged site owners to install fixes immediately, according to a translation by Business Insider. Mizuho’s banking and securities arms halted services on Thursday, Bloomberg reported. Shizuoka Bank suspended its website and app, while MUFG group companies stopped some online services. All Nippon Airways disabled Apple Wallet boarding passes, and Japan Airlines and East Japan Railway took down web services. Chief Cabinet Secretary Minoru Kihara confirmed that no attacks exploiting the flaws had been verified.
The context
The PHP Foundation has not observed working exploits in the wild, according to executive director Elizabeth Barron, who spoke to CNBC. However, security researcher Matt Suiche of Tolmo told CNBC that his team developed a working exploit in less than a day. Ryan Austin, a California-based researcher who helped identify the flaws, told The Guardian that exploitation does not yet appear to be widespread. The US cyber agency CISA stated in its Wednesday alert that it had not seen exploitation at the time of publication.
What to watch
- Monitor for updates on whether the millions of attempts have resulted in any confirmed data breaches.
- Watch for new advisories from national cyber agencies regarding the ease of exploitation.
- Observe if major service providers resume operations or if disruptions continue to spread.
What it means for organisations
Organisations should immediately verify whether their infrastructure relies on the affected software. Teams usually need to assess their exposure by checking server configurations and third-party dependencies. It is critical to inform senior leadership and legal counsel about potential service interruptions. Operations staff should prepare for possible downtime if patches are not yet available. Suppliers should be contacted to confirm their mitigation status. Internal communications must clarify that while attack volume is high, confirmed breaches remain rare, reducing immediate panic but requiring sustained vigilance.
What to do and how to stay safe: PHP
- Check your web servers and applications to determine if they use the vulnerable version of PHP.
- Review your web application firewall logs for spikes in traffic that match known exploit patterns.
- Ensure your incident response plan is ready in case a breach is confirmed in your environment.
- Coordinate with your hosting provider to see if they are applying network-level protections while you wait for an official update.
Step-by-step guide: Secure Home Routers for Small Business Networks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Has anyone successfully hacked systems using PHP2Shell?
No, officials in Germany, the Netherlands, and Japan, as well as US agency CISA, have confirmed no successful exploits.
How many attack attempts were recorded?
Cloudflare reported seeing millions of attempts to exploit the vulnerability following its public disclosure.
Did any major companies suffer data breaches?
No, major Japanese firms that shut down services, such as All Nippon Airways, stated they found no evidence of a breach.
