Cloudflare CEO Warns PHP Flaw Has Triggered Millions of Exploit Attempts

Cloudflare CEO Matthew Prince said the company’s network has recorded millions of exploit attempts since two critical PHP vulnerabilities became public. In a Thursday post on X, he noted that thousands of attempts had already appeared in the 10 hours before disclosure. Cloudflare helps websites load faster and defends them from attacks, and about one in five sites worldwide sends traffic through its network, according to the company. That scale makes its numbers a useful signal of how quickly attackers moved once the flaws were known.

Critical PHP Security Flaws and Emergency Patches

On Wednesday, the PHP Foundation admitted that a shortage of resources delayed a fix for a serious flaw first identified in 2024, and developers released emergency patches for both vulnerabilities the same day. The bugs could let attackers spread malware or inject malicious scripts into sites around the world. W3Techs estimates PHP powers about 69% of websites with a known server-side programming language, which is why the potential reach is so wide.

FBI Urges Immediate PHP Updates

The FBI’s Cyber Division warned that the flaws may allow malicious actors to remotely execute code in PHP core, which could expose sensitive data and networks. It urged organizations to either install the update right away or take affected systems offline. Many organizations and government agencies had already pulled websites offline on Wednesday as a precaution.