Tokyo: Cloudflare has reported millions of attempts to exploit critical security vulnerabilities in PHP, raising concerns about the safety of websites and online services worldwide. The surge in detected activity followed the public disclosure of the flaws on October 21, prompting governments, technology companies and organisations to take urgent steps to protect their systems.
Cloudflare chief executive Matthew Prince said the number of attempts observed across the company's network rose from thousands before public disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time of his statement.
The figures describe attempted exploitation rather than confirmed successful attacks. They do not establish how many websites were compromised. However, the rapid increase highlights the risks that emerge when details of serious software vulnerabilities become publicly available.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are known collectively as PHP2Shell. They can allow attackers to execute malicious code remotely without authentication under affected conditions. Successful exploitation could also expose sensitive information stored in a server's memory or disrupt online services.
The PHP development team released security updates on October 21 for versions 8.2, 8.3, 8.4 and 8.5. The patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The team urged users to install the updates immediately. Older versions, including PHP 8.1 and earlier, are also affected, although these versions no longer receive security updates from the main PHP project.
The vulnerabilities affect the underlying PHP software rather than a particular website or plugin. As a result, updating a website's content management system alone may not resolve the problem. Organisations using affected versions must update the PHP software itself or contact their hosting providers to ensure that the necessary security fixes have been applied.
The United Kingdom's National Cyber Security Centre advised organisations to identify affected systems, prioritise internet facing services and monitor for suspicious activity. Organisations unable to apply security updates immediately were advised to consider taking vulnerable systems offline until they could be secured.
The warning has led to precautionary measures across several countries. Government agencies and businesses in Europe and Asia temporarily suspended some online services while assessing their exposure and applying security updates. The Netherlands, France, Denmark and Finland were among the countries where public websites or services were taken offline as a precaution.
In Japan, companies and public agencies also suspended some online operations. Reuters reported on October 23 that the country planned to establish a specialised team to simulate cyberattacks using artificial intelligence as part of efforts to strengthen its cyber defences. The disruptions highlighted the importance of protecting essential digital services, including banking, transport and government systems.
Another significant development came from Amazon Web Services, which reported detecting an attempt to exploit the vulnerabilities against its MadPot honeypot on October 17, four days before the public disclosure. A honeypot is a monitored system designed to attract and study suspicious activity.
Amazon also detected further attempts around the time of the public announcement. The company said it remained unclear how the actor behind the earlier attempt had obtained information about the vulnerabilities before disclosure. Its findings did not establish whether the attempt would have succeeded against a real production system.
The early activity raises questions about whether information about the flaws reached malicious actors before the public announcement. However, the available evidence does not identify the responsible party or explain how the information was obtained.
The vulnerabilities were discovered with the help of artificial intelligence assisted security research. Researchers from Calif and cybersecurity company Wiz reported findings involving AI tools, while other researchers and the PHP development team contributed to the investigation and correction process. The security fixes were released after the vulnerabilities had remained hidden in the software for years.
The episode demonstrates how AI can help security researchers identify weaknesses in complex software. However, the same advances may also help attackers analyse vulnerabilities and develop exploitation methods more quickly. There is no confirmed evidence that AI alone caused the surge in attempts reported by Cloudflare.
PHP remains widely used to build and operate websites and web applications, including platforms such as WordPress, Drupal and Joomla. Its extensive use means that a critical flaw in the underlying software can create risks for organisations across different industries and countries.
Security teams now face the challenge of identifying vulnerable systems, installing updates and investigating any signs of unauthorised access. Although the number of attempted exploits has risen sharply, the total number of successful compromises remains unclear.
The response will depend on how quickly organisations secure affected systems and determine whether attackers gained access before the protective measures were introduced. Authorities and technology companies continue to urge website operators to apply the available fixes and monitor their systems for suspicious activity.