Millions of exploit attempts after critical PHP flaws disclosed, Cloudflare says

FBI warns of remote code execution risk; multiple organizations take websites offline as a precaution

By LineZotpaper

Published22 October 2026

Updated22 October 2026

Read Time2 min

Sources3 outlets

Cloudflare CEO Matthew Prince warned Thursday that the company's network detected millions of exploit attempts following the public disclosure of two critical vulnerabilities in the PHP programming language, with thousands of attempts observed even before the vulnerabilities were publicly announced.

Cloudflare, an internet infrastructure company that handles traffic for about one in five websites worldwide, saw exploit attempts escalate from thousands in the 10 hours before disclosure to millions afterward, Prince said in a post on X.

The PHP Foundation released emergency patches for the two critical vulnerabilities on Wednesday, the same day it acknowledged that a shortage of resources had delayed a fix for one of the flaws, which was first identified in 2024.

The vulnerabilities could allow attackers to remotely execute code on PHP core, potentially compromising sensitive data and networks, according to a warning from the FBI's Cyber Division, also posted Wednesday. The FBI urged organizations to either apply the update immediately or take affected systems offline.

PHP is used by an estimated 69% of websites with a known server-side programming language, according to research service W3Techs. Multiple organizations and government agencies took their websites offline Wednesday as a precautionary measure, including Oxford City Council and the City of Edinburgh Council, according to RTÉ News.

The scale of exploitation underscores the widespread risk posed by vulnerabilities in widely used infrastructure software, particularly when patches are delayed due to resource constraints in open-source projects.

Analysis

Why This Matters

The vulnerabilities affect a core technology powering the majority of websites globally, putting user data and site integrity at risk.
The speed and volume of exploit attempts, millions within hours of disclosure, show attackers are aggressively targeting the flaw.
Government agencies and businesses taking sites offline indicates the severity is being treated as an operational emergency.

Background

PHP is a server-side scripting language that underpins content management systems, e-commerce platforms, and countless custom web applications. The PHP Foundation, a volunteer-supported organization, oversees maintenance of the language. Resource constraints within open-source projects are a longstanding concern, and this incident highlights how a single delayed patch can cascade into a widespread security incident.

Key Perspectives

Cloudflare CEO Matthew Prince: The network observed exploit attempts rising from thousands before disclosure to millions after, indicating attackers had early awareness of the vulnerabilities. FBI Cyber Division: The vulnerabilities represent a serious threat, and organizations should patch immediately or disconnect affected systems. Critics/Skeptics: The delayed fix due to resource shortages in the PHP Foundation raises questions about the sustainability of maintaining critical infrastructure software through volunteer-driven projects.

What to Watch

The extent of confirmed compromises and data breaches in the days and weeks ahead.
Whether the PHP Foundation secures additional resources to prevent similar delays.
Possible regulatory or industry action to fund maintenance of widely used open-source software.

Sources

Hackers launch ‘millions’ of attempts to exploit global PHP cyber flaw · Politico Europe
PHP flaw draws millions of exploit attempts, Cloudflare CEO warns · Cointelegraph.com News
Companies and govts step up cyber defences after PHP flaw · RTÉ News

Checked

12 claims in this story checked against 2 sources: 9 supported.

Show each claim

SupportedCloudflare detected millions of exploit attempts after two critical PHP vulnerabilities were disclosed, with thousands of attempts before disclosure.Cointelegraph.com News: “In the 10 hours before the vulnerabilities’ disclosure, the network saw thousands of exploit attempts, which have now reached “millions,” Prince said in a Thursday X post.”
SupportedThe FBI warned that the PHP vulnerabilities could allow remote code execution.Cointelegraph.com News: “The two critical vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” warned the FBI’s Cyber Division in a Wednesday X post”
SupportedMultiple organizations and government agencies took websites offline Wednesday as a precaution.Cointelegraph.com News: “Multiple organizations and government agencies took websites offline Wednesday as a precautionary measure.”
SupportedCloudflare routes traffic for about one in five websites worldwide.Cointelegraph.com News: “About one in five websites worldwide routes traffic through its network, according to the company.”
Partly supportedThe PHP Foundation released emergency patches for the two vulnerabilities on Wednesday.Cointelegraph.com News: “On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024. PHP developers released emergency patches for two critical vulnerabilities on the same day.”
SupportedThe PHP Foundation acknowledged that a shortage of resources had delayed a fix for a critical flaw.Cointelegraph.com News: “On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024.”
SupportedThe flaw was first identified in 2024.Cointelegraph.com News: “On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024.”
SupportedThe vulnerabilities could allow attackers to execute code on PHP core and potentially compromise sensitive data and networks.Cointelegraph.com News: “The two critical vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” warned the FBI’s Cyber Division in a Wednesday X post”
SupportedThe FBI urged organizations to update immediately or take affected systems offline.Cointelegraph.com News: “urging organizations to either adopt an immediate update or take affected systems offline.”
SupportedPHP is used by an estimated 69% of websites with a known server-side programming language.Cointelegraph.com News: “PHP powers an estimated 69% of websites with a known server-side programming language, according to research service W3Techs.”
Partly supportedOxford City Council and the City of Edinburgh Council took their websites offline Wednesday.RTÉ News: “Oxford City Council and the City of Edinburgh Council were among the organisations to take their websites offline”
Not in the sourcesThe scale of exploitation underscores widespread risk from widely used infrastructure software, particularly when open-source projects delay patches because of resource constraints.

Correction

22 October 2026An earlier version of this story said specific entities that took websites offline were not named. RTÉ News named Oxford City Council and the City of Edinburgh Council among those that did.