Hackers launch millions of attacks exploiting critical PHP vulnerability

Security flaw in programming language underlying 70 percent of the web triggers global response

By LineZotpaper

Published22 October 2026

Read Time2 min

Cyberattackers have made millions of attempts to exploit a critical security vulnerability in PHP, a foundational programming language that powers roughly 70 percent of the internet, a major cybersecurity provider said Thursday. European government websites have been taken offline as a precaution.

Cloudflare CEO Matthew Prince said in a post on X that his company had detected millions of attempts to exploit the vulnerability. Prince noted that thousands of hits were recorded in the ten hours before the flaw was publicly disclosed, meaning information must have leaked in advance. Within 45 minutes after disclosure, the number grew to tens of thousands, within two hours to hundreds of thousands, and eventually to millions.

Amazon's cloud division also said the vulnerability is currently being exploited at scale.

In response, multiple European government agencies took their websites offline as a precaution. Thursday morning, prominent French sites including those of the justice ministry and the data protection authority displayed maintenance notices. The Dutch cybersecurity authority, led by Matthijs van Amelsfort, told POLITICO it had no evidence of active exploitation in the Netherlands, but warned the situation could change, especially as artificial intelligence makes it easier to exploit vulnerabilities. The Dutch authority had taken its own site offline Wednesday but it has since been restored.

Analysis

Why This Matters

The PHP vulnerability affects an estimated 70 percent of websites, potentially exposing sensitive user data and enabling widespread attacks.
Government sites in several European countries have been temporarily taken offline, highlighting the severity of the threat.
The rapid escalation from pre-disclosure leaks to mass exploitation within hours underscores the challenge of coordinating patch deployment.

Background

PHP is a server-side scripting language used by a vast majority of websites, including content management systems like WordPress. Vulnerabilities in PHP can grant attackers remote code execution, allowing them to compromise servers, steal data, or launch further attacks. The specific flaw exploited here has not been detailed, but its critical nature prompted immediate action from cybersecurity authorities.

Key Perspectives

Cloudflare and Amazon: The two internet infrastructure giants report seeing large-scale exploitation of the vulnerability. Their visibility into global traffic patterns suggests the flaw is being actively targeted by attackers.

Dutch Cybersecurity Authority: Led by Matthijs van Amelsfort, the agency currently sees no active exploitation in the Netherlands but acknowledges the risk may increase, particularly with AI-assisted attack tools. The authority's decision to briefly take its site offline reflects a precautionary approach.

European Governments: French and Dutch government websites were taken offline, indicating a defensive response. The lack of official statements suggests authorities are prioritizing patching and monitoring over public commentary.

What to Watch

Whether more government and corporate websites are taken offline or compromised in the coming days.
The speed and completeness of patch deployment by hosting providers and site operators.
Reports of data breaches or ransomware attacks linked to the PHP vulnerability.

Sources

Hacker starten „Millionen“ von Angriffen, um eine weltweite PHP-Sicherheitslücke auszunutzen · Politico Europe

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim

Partly supportedHackers launched millions of attacks exploiting the PHP vulnerability.Politico Europe: “Cyberangreifer haben „Millionen“ von Versuchen unternommen, eine kritische Sicherheitslücke in einem Grundbaustein des Internets auszunutzen”
SupportedThe PHP flaw triggered a global response.Politico Europe: “Cybersicherheitsbehörden weltweit bemühten sich am Mittwoch, auf eine Sicherheitslücke in PHP ... zu reagieren.”
SupportedPHP underlies roughly 70 percent of the internet.Politico Europe: “einer grundlegenden Programmiersprache, auf der 70 Prozent des Internets basieren.”
SupportedA major cybersecurity provider said Thursday that cyberattackers had made millions of attempts to exploit the critical PHP vulnerability.Politico Europe: “Cyberangreifer haben „Millionen“ von Versuchen unternommen, eine kritische Sicherheitslücke in einem Grundbaustein des Internets auszunutzen, teilte ein bedeutender Anbieter von Cyberdiensten am Donnerstag mit.”
SupportedEuropean government agencies took their websites offline as a precaution.Politico Europe: “Zahlreiche europäische Regierungsbehörden haben ihre Websites vorsorglich offline genommen.”
SupportedCloudflare CEO Matthew Prince said the company detected thousands of hits in the ten hours before public disclosure, which meant information must have leaked in advance.Politico Europe: “„In den zehn Stunden vor der öffentlichen Bekanntgabe der Sicherheitslücke wurden Tausende Zugriffe verzeichnet, was bedeutet, dass Informationen durchgesickert sein müssen”
SupportedPrince said the number rose to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions eventually.Politico Europe: “in den 45 Minuten nach der Bekanntgabe waren es dann Zehntausende, innerhalb von zwei Stunden Hunderttausende und mittlerweile Millionen“, sagte Prince.”
SupportedAmazon’s cloud division said the vulnerability was currently being exploited at scale.Politico Europe: “Die Cloud-Sparte von Amazon teilte zudem mit, dass die Sicherheitslücke „derzeit in großem Umfang ausgenutzt wird“.”
SupportedProminent French sites, including the justice ministry and data protection authority websites, displayed maintenance notices Thursday morning.Politico Europe: “Am Donnerstagmorgen gaben wichtige französische Websites wie die des Justizministeriums und der Datenschutzbehörde an, dass derzeit Wartungsarbeiten durchgeführt würden.”
Partly supportedThe Dutch cybersecurity authority, led by Matthijs van Amelsfort, told POLITICO it had no evidence of active exploitation in the Netherlands.Politico Europe: “Matthijs van Amelsfort, Leiter der niederländischen Cybersicherheitsbehörde, erklärte gegenüber POLITICO, dass seine Behörde keine Hinweise darauf habe, dass die Sicherheitslücke „aktiv ausgenutzt“ werde”
SupportedVan Amelsfort warned the situation could change, especially because AI makes exploiting vulnerabilities easier.Politico Europe: “fügte jedoch hinzu, dass sich dies ändern könne, insbesondere da künstliche Intelligenz die Ausnutzung von Sicherheitslücken erleichtere.”
SupportedThe Dutch authority took its website offline Wednesday and has since restored it.Politico Europe: “Die Behörde hatte ihre Website am Mittwoch offline genommen, sie ist nun jedoch wieder verfügbar.”