Cloudflare sees millions of attacks exploiting newly disclosed PHP flaws
What's the story
Cloudflare, a leading cloud services provider, has reported millions of attempts to exploit critical vulnerabilities in the PHP programming language. The alarming spike was revealed by CEO Matthew Prince in a post on X. He said that thousands of exploitation attempts were recorded across their network within 10 hours before the vulnerabilities were publicly disclosed.
Attack escalation
Tens of thousands to millions in 2 hours
Prince further detailed the surge in exploitation attempts after the public announcement of PHP vulnerabilities.
He said that within 45 minutes of the disclosure, the number jumped from thousands to tens of thousands. Within two hours, it had already reached hundreds of thousands and has now crossed millions.
This rapid increase highlights how quickly hackers can act on newly revealed vulnerabilities.
Twitter Post
Take a look at Price's post
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
— Matthew Prince 🌥 (@eastdakota) October 22, 2026
Impact on services
Disruption caused by PHP vulnerabilities
The disclosure of PHP vulnerabilities has caused a major disruption, with government websites in Europe and other regions going offline.
Japanese lender Mitsubishi UFJ Financial Group announced a temporary suspension of some internet services as an emergency measure.
Even Japan's Finance Ministry also temporarily suspended some website content and services while security measures were being implemented.
Urgent updates
Emergency patches released
In light of these vulnerabilities, PHP developers have released emergency patches and urged all users to update their systems as soon as possible.
Japanese Prime Minister Sanae Takaichi also urged website owners to check whether their sites use PHP and prepare to apply the new fix.
This incident highlights the importance of quick action in response to cybersecurity threats like this one.