Cloudflare CEO Matthew Prince reported that the company's network recorded thousands of exploit attempts targeting a critical PHP vulnerability even before its public disclosure. Following the official announcement, the number of such attempts surged to millions.
The PHP Foundation released emergency patches for two critical security flaws on Wednesday. The organization attributed the delay in fixing the issues, which were initially identified in 2024, to a shortage of resources.
The FBI's Cyber Division issued a warning stating that these vulnerabilities could enable remote code execution in the PHP core, risking data and network integrity. The agency advised organizations to update their systems immediately or take them offline.
Many government agencies and organizations opted to take their websites offline as a precautionary measure. PHP currently powers approximately 69% of websites that utilize a known server-side programming language, according to W3Techs.
