PHP2Shell: what happened in the first 24 hours after disclosure

After PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was publicly disclosed, Imperva recorded a sharp increase in scanning and exploitation attempts.

The first 24 hours of attacker activity in numbers: • 482,342 requests associated with scanning and/or exploitation attempts. • 122,311 attack sessions with an average of 3.9 requests per session. • 21,998 targeted resources with an average of about 22 requests per site. • 103 countries, where the targeted resources were located.

The first information about the vulnerability appeared on October 20 at 15:20 (UTC), while Imperva observed the first unsuccessful probing attempts around 12:00 on October 21, before the official patch was released at 13:48. About seven hours after the patch was published, activity peaked at 94,870 requests per hour, followed by a second notable spike on the morning of October 22 — to approximately 42,000 requests per hour.

64.5% of the targeted sites were located in the United States, followed by Indonesia, Australia, Germany, and Brazil. By industry, business led the list at 34.3%, followed by education and financial services.

The level of automation is also worth noting: about half of the requests originated from known bots and tools based on Go HTTP libraries. This clearly shows how quickly tools for mass scanning emerge after a critical vulnerability is disclosed.

The attacks began before the official patch was released: shortly after the public information appeared, automated scanners started looking for potential targets. As a result, the response window effectively begins when the vulnerability is disclosed, not when a patch or an exploit becomes available — and is measured in hours, not days.

Vulnerabilities

Researchers

Vendors

Products