Cloudflare Reports Millions of Attempts to Exploit Critical PHP Security Flaws
What Happened
On October 22, 2026, Cloudflare CEO Matthew Prince reported millions of attempts to exploit two critical PHP vulnerabilities following their public disclosure. Attempts rose from thousands before disclosure to hundreds of thousands within two hours. PHP developers released emergency security updates on October 21. Government websites in Europe and some Japanese financial services were temporarily suspended as precautions.
Key Takeaways
The surge highlights security risks affecting websites that use vulnerable PHP versions. Developers have released fixes, but the reported attack attempts do not establish how many systems were successfully compromised.