Matthew Prince, Cloudflare co-founder and CEO Credit: Cloudflare Cloudflare has recorded millions of attempts to exploit two critical PHP vulnerabilities since details became public on Wednesday, according to CEO Matthew Prince. The flaws affect PHP, a programming language used to power much of the web. Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.
That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now. — Matthew Prince 🌥 (@eastdakota) October 22, 2026 Prince shared the figures on X late Wednesday. Cloudflare had seen thousands of exploit attempts in the 10 hours before the vulnerabilities were disclosed. That rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by the time he posted. The vulnerabilities, dubbed PHP2Shell, allow attackers to execute code on a web server without logging in.
PHP rated both flaws 9.2 out of 10 for severity and released emergency patches for versions 8.2 through 8.5 on Wednesday, a day ahead of schedule after technical details leaked online. Security firms Calif and Wiz, along with OpenAI, have said AI tools helped identify the vulnerabilities. PHP has urged users to install the updates immediately. Cloudflare enabled firewall rules for all customers, including those on free plans, about nine hours before the flaws were publicly disclosed.
The company has warned that the rules offer only temporary protection and do not remove the need to update PHP itself. The vulnerabilities have also prompted organisations around the world to take websites and online services offline while applying patches. Several European government websites went dark on Wednesday after CERT-EU warned that unpatched sites might need to be taken offline to reduce the risk of attacks. In Japan, Mitsubishi UFJ Financial Group temporarily suspended some internet services as a precaution, Reuters reported.
The Finance Ministry also halted some website content and services while implementing security measures. Prime Minister Sanae Takaichi urged website operators to check whether their sites use PHP and prepare to apply the fixes, Reuters said. Operators running PHP versions older than 8.2 face an additional challenge: those releases no longer receive official support. They may need to rely on their software vendors or hosting providers for patches, leaving them with fewer options for securing outdated systems.
Get the TNW newsletter ✕ Close Get the TNW newsletter Get the most important tech news in your inbox each week.
Leave a Reply