Cloudflare has recorded millions of attempts to exploit critical vulnerabilities in PHP, a widely used programming language that powers websites worldwide. The surge followed the public disclosure of the security flaws, prompting website operators and government agencies to take urgent measures to protect their systems.
Cloudflare CEO Matthew Prince reported the sharp increase in exploitation attempts in a post on X late on October 21. The development follows PHP developers releasing emergency fixes for vulnerabilities that had gone undetected for years before artificial intelligence (AI) uncovered them.
Prince said Cloudflare observed thousands of attempts to exploit the vulnerabilities in the 10 hours before their public announcement. The number rose to tens of thousands within 45 minutes of disclosure, reached hundreds of thousands within two hours, and eventually climbed into the millions.
The rapid increase highlights how quickly attackers can respond when details of a security vulnerability become public. Website operators across several countries have been scrambling to assess their exposure and implement protective measures.
Government websites in Europe and other regions went offline on October 21 following the disclosure, as organizations worked to secure potentially affected systems.
Also Read: What Cloudflare’s New Class of Models Means for AI-Powered Data Extraction
PHP developers released urgent security updates on October 21 and urged users to update their systems immediately. The vulnerabilities reportedly existed in the software for years before researchers identified them with AI assistance.
PHP powers many websites, so security weaknesses in the language concern website owners, businesses and public institutions. The disclosure has increased pressure on organizations to determine whether their websites use PHP and whether they require the latest fixes.
On October 21, Japanese Prime Minister Sanae Takaichi also urged website owners to check whether their sites use PHP and prepare to apply the updates.
The disclosure's impact extended to Japan, where Mitsubishi UFJ Financial Group temporarily suspended some internet services as part of emergency measures.
Japan's Finance Ministry also temporarily suspended some website content and services while it implemented security measures. The disruptions underscore the potential consequences of vulnerabilities in widely used software, especially when attackers begin exploiting them at scale.
With exploitation attempts reaching millions, affected organizations' immediate priority is to identify vulnerable systems and apply available security updates. PHP developers urge users to update immediately to reduce attack risk.