PHP2Shell Fallout: Millions of Hacking Attempts and What Nadella Said
After the PHP2Shell flaws, hacking attempts have surged into the millions and services have shut down worldwide. Here’s what happened and how to protect your site.
Tekex
10/24/20262 min read
PHP2Shell Fallout: Millions of Hacking Attempts, Shutdowns and What Nadella Said
Published: October 25, 2026
A few days ago, we explained the two critical PHP flaws known as PHP2Shell. The story has since grown into one of the biggest cyber events of the year. Here’s what has happened since, and what it means for you.
Hacking attempts have exploded
Attackers moved quickly once fixes went public. Reports say attempts jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions since. Websites are in a race: patch before attackers find them. abc
Services shut down across the world
Banking, airline, rail, tax and government services were shut down as an emergency measure, from Tokyo to Helsinki. CERT-EU and the UK’s NCSC urged organisations to patch immediately, or to consider shutting systems down to prevent compromise. Australia’s Signals Directorate was among the agencies that issued urgent warnings. Hacking attempts surge as websites race to patch PHP issues - ABC News +2
What did Satya Nadella say?
That’s why his name is trending. Speaking at Microsoft’s AI Tour event in Germany, Nadella said he had not seen anything like this in a long, long time. He also acknowledged it had been a long day and night for IT and security teams. itpro
The AI angle
The flaws were old, but the discovery was new. The vulnerabilities had lurked in PHP’s code for years until AI was used to uncover them. The same type of tool that finds bugs for defenders can find them for attackers, which is why many experts expect more events like this. abc
This ties into Nadella’s other recent message. On October 10, he posted that companies should assume AI models are compromised and keep a human-run “emergency brake” to stop them. On October 19, Microsoft launched Guardian Agents, a feature to monitor the AI agents a company uses. thebackroomtechTechCrunch
What you should do
If you run a website:
Update PHP now. Move to a patched release (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer).
Check your logs for unusual requests or files since October 21.
Ask your hosting provider to confirm they have patched.
If you’re a regular internet user:
Expect some outages. Some sites and services may be briefly offline while they patch.
Be careful with scam messages. Attackers use big events as bait, so avoid clicking links claiming “security alerts” or “account verification.”
Use strong, unique passwords and two-factor authentication on important accounts.
The bottom line
PHP2Shell shows how quickly a hidden bug can become a worldwide emergency, and how important fast updates are. If you manage a site, patch it today. If you don’t, stay alert for scams.