PHP patches go full send as exploit attempts hit millions

Cloudflare CEO Matthew Prince said the company’s network saw millions of exploit attempts after two critical PHP vulnerabilities were publicly revealed. According to his Thursday X post, the network recorded thousands of attempts in the 10 hours before disclosure before the total climbed to “millions.”

Cloudflare is an internet infrastructure company that helps websites load faster and protects them from cyberattacks. About one in five websites worldwide routes traffic through its network, according to the company. On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024. PHP developers released emergency patches for two critical vulnerabilities on the same day.

The vulnerabilities may allow attackers to spread malware or inject malicious scripts into websites around the world. PHP powers an estimated 69% of websites with a known server-side programming language, according to research service W3Techs.

The FBI’s Cyber Division warned in a Wednesday X post that the flaws may “allow malicious cyberactors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” urging organizations to either adopt an immediate update or take affected systems offline. Multiple organizations and government agencies took websites offline Wednesday as a precautionary measure.