Attackers have made millions of attempts to exploit PHP2Shell since it was disclosed, but officials in Germany, the Netherlands and Japan say they have not seen a single one succeed.
PHP2Shell is a newly disclosed security flaw that attackers are trying to exploit. The name hints at PHP, the scripting language behind a large share of the web, and at a "shell", which is the command access an attacker gets when they can run instructions on someone else's server. Cloudflare chief executive Matthew Prince gave the attempt count in a post on X, drawn from traffic crossing Cloudflare's network. The three national governments are the ones reporting no confirmed break-ins so far.
Those two facts measure different things. An exploit attempt is cheap: automated scanners can fire off millions of requests at little cost, whether or not any target is vulnerable. A confirmed breach requires a working attack against a system that was exposed, plus someone noticing. The first number shows how fast attackers moved. The second shows only what defenders have found so far.
The pattern is familiar. When Log4Shell, a flaw in a widely used Java logging library, was disclosed in December 2021, mass scanning started within hours, and real compromises followed in the days after. Heavy early scanning has tended to signal that attackers see a flaw as worth the effort, not that they have succeeded.
The government statements come from three countries, which is a useful spread but a small sample of the world's servers. Whether the count of confirmed intrusions stays at zero depends on how many systems are exposed and how quickly their operators patch, and neither figure has been published.