PHP flaw draws millions of exploit attempts, Cloudflare CEO warns

Cloudflare’s CEO Matthew Prince warned that the network saw millions of exploit attempts after two critical PHP vulnerabilities were publicly revealed.

In the 10 hours before the vulnerabilities’ disclosure, the network saw thousands of exploit attempts, which have now reached “millions,” Prince said in a Thursday X post.

Cloudflare is an internet infrastructure company that helps websites load faster and protects them from cyberattacks. About one in five websites worldwide routes traffic through its network, according to the company.

On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024. PHP developers released emergency patches for two critical vulnerabilities on the same day.

The vulnerabilities may allow attackers to spread malware or inject malicious scripts into websites around the world. PHP powers an estimated 69% of websites with a known server-side programming language, according to research service W3Techs.

The two critical vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” warned the FBI’s Cyber Division in a Wednesday X post, urging organizations to either adopt an immediate update or take affected systems offline.