Cloudflare CEO Matthew Prince reported that the company’s network intercepted millions of exploit attempts following the public disclosure of two critical PHP vulnerabilities. Prince stated on Thursday that while only thousands of attempts were observed in the ten hours preceding the disclosure, the volume surged to millions shortly after. Cloudflare, which routes traffic for approximately one in five websites globally, serves as a key infrastructure layer for mitigating such attacks.
The PHP Foundation acknowledged on Wednesday that resource shortages had delayed fixes for security flaws first identified in 2024. Emergency patches for the two vulnerabilities were released on the same day. These flaws enable attackers to remotely execute code within the PHP core, potentially allowing malware distribution or malicious script injection across websites. According to W3Techs, PHP powers an estimated 69% of websites with known server-side programming languages.
The FBI’s Cyber Division issued a warning via X on Wednesday, urging organizations to immediately update affected systems or take them offline to prevent compromise of sensitive data and networks. In response to the heightened risk, multiple government agencies and private organizations took websites offline as a precautionary measure.
The rapid escalation from thousands to millions of exploit attempts underscores the immediate weaponization potential of disclosed software vulnerabilities. This incident highlights the fragility of open-source maintenance, where resource constraints can delay critical security patches for years, leaving a vast majority of web infrastructure exposed. The disparity between the time required to identify the flaw (2024) and its emergency patching illustrates a systemic gap in proactive security management for widely used technologies.
From an operational risk perspective, the coordinated shutdown of websites by government entities signals a shift toward defensive paralysis when mitigation is uncertain. While Cloudflare’s infrastructure absorbed the initial wave of attacks, the underlying vulnerability remains a structural weakness for any site relying on unpatched PHP cores. Organizations must now weigh the cost of downtime against the risk of remote code execution, particularly as threat actors automate exploitation at scale following public disclosures.
