PHP2Shell Flaws Trigger Exploit Surge and Game Outages

Two critical PHP vulnerabilities known as PHP2Shell have prompted widespread exploitation attempts and disruptions at game companies. According to Kotaku, Cloudflare recorded millions of exploit attempts against the PHP flaw by 22 October 2026, and Square Enix confirmed unauthorised third-party access while multiple Pokémon apps went offline for emergency maintenance.

The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution and are rated 9.2 out of 10 on the CVSS scale. Wiz Research, which discovered the PHP vulnerability, said AI makes complex exploits easier to develop and scale.

Separately, GitLab reported CVE-2026-110264, a remote code execution flaw rated 10 out of 10 on the CVSS scale, the night before the article's publication.

Earlier exploitation activity

In the 10 hours before the PHP vulnerability was publicly announced, Cloudflare saw thousands of exploit attempts, jumping to tens of thousands within 45 minutes of the announcement.

The incidents follow earlier reports that two of Japan's oldest mobile games will be permanently sunset following the discovery of the PHP vulnerability. The National Security Agency and the National Cyber Security Centre have not commented on the latest developments.