PHP Flaws Draw Millions of Exploit Attempts, Cloudflare CEO Says

Cloudflare CEO Matthew Prince said the company’s network detected thousands of exploit attempts against two critical PHP vulnerabilities during the 10 hours before their public disclosure, with activity subsequently rising to millions. Prince shared the warning in a Thursday post on X, highlighting the speed at which attackers began scanning and targeting vulnerable systems.

The PHP Foundation acknowledged that limited resources delayed a fix for a critical vulnerability first identified in 2024. PHP developers subsequently released emergency patches for both flaws on Wednesday. The vulnerabilities could allow attackers to execute malicious code or insert scripts into affected websites.

The FBI’s Cyber Division warned that the issues could enable remote code execution in PHP core and potentially expose sensitive data and entire networks. It urged organizations to update affected systems immediately or take them offline as a precaution, prompting multiple organizations and government agencies to remove websites from service temporarily.

PHP powers an estimated 69% of websites that use a known server-side programming language, according to W3Techs. Cloudflare, which routes traffic for roughly one in five websites, said the rapid growth in exploit attempts demonstrates the scale of the potential exposure.