Cloudflare’s network recorded millions of attempts to exploit two critical vulnerabilities in PHP after the flaws were publicly disclosed, CEO Matthew Prince warned. The activity highlights the rapid pace at which attackers can target widely used web infrastructure once details of a security weakness become known.
Exploit activity surged after disclosure
According to Cointelegraph, Prince said in a Thursday post on X that Cloudflare detected thousands of exploit attempts during the 10 hours before the vulnerabilities were made public. That activity later increased to “millions,” he said, without providing a more detailed breakdown of the attempts.
Cloudflare provides internet infrastructure services that help websites deliver content and defend against cyberattacks. The company says roughly one in five websites worldwide routes traffic through its network, giving it visibility into a large volume of internet activity.
The vulnerabilities affect PHP, a programming language used on web servers. PHP is estimated to power about 69% of websites whose server-side programming language is known, according to W3Techs. That broad use means a flaw in PHP can potentially affect websites and networks across many sectors.
Emergency patches and warnings
The PHP Foundation said Wednesday that limited resources had delayed a fix for one critical security problem that was first identified in 2024. PHP developers released emergency patches for two critical vulnerabilities on the same day.
The flaws may allow attackers to place malicious scripts on websites or distribute malware. The FBI’s Cyber Division warned that they could also enable malicious actors to execute code remotely in PHP’s core. Such access could put sensitive information and connected networks at risk.
The FBI urged organizations to install the updates immediately or take affected systems offline. Several organizations and government agencies did so temporarily on Wednesday as a precaution.
A software vulnerability is a weakness that can be exploited to make a program perform actions its developers did not intend. A patch is an update designed to correct that weakness. The reported rise in exploitation attempts underlines the importance of the period between public disclosure and the installation of security updates, although the source material does not specify how many attacks succeeded or which organizations were affected.
Moneyiar market picture
Moneyiar market data recorded at about 11:13–11:14 p.m. on Oct. 22, 2026, showed declines across the four listed digital assets over the previous 24 hours:
- Lighter (LIT): $3.4219315695, down 11.15%; up 13.08% over seven days.
- Flare (FLR): $0.0062470204, down 3.56%; down 6.55% over seven days.
- Plasma (XPL): $0.0754305023, down 8.54%; down 11.49% over seven days.
- The Sandbox (SAND): $0.0535014457, down 7.81%; down 5.06% over seven days.
These figures are Moneyiar data at the stated time and describe market movements; they do not establish a connection between those prices and the PHP vulnerabilities.
