PHP vulnerability triggers millions of attacks
Cloudflare CEO Matthew Prince warned that exploitation attempts targeting two critical PHP vulnerabilities have surged to millions.
According to W3Techs, PHP, as a known server-side programming language, powers approximately 69% of websites.
The FBI urges organizations to immediately install security patches or take affected systems offline.
A critical security vulnerability in PHP has triggered millions of cyberattacks, raising concerns about the security of websites and user data worldwide. Cloudflare CEO Matthew Prince warned that the number of attacks surged rapidly after these two vulnerabilities were disclosed.
The FBI and other cybersecurity agencies are urging website owners to immediately install security updates or take affected websites offline until they can be confirmed as secure.
PHP vulnerability triggers millions of attacks
In a recent post on X, Matthew Prince stated that Cloudflare’s network observed thousands of exploitation attempts in the 10 hours prior to the vulnerability disclosure.
Within 45 minutes of the announcement, this number surged to tens of thousands, reached hundreds of thousands within two hours, and has now climbed to millions.
These two vulnerabilities, known as PHP2Shell, are assigned the IDs CVE-2026-109618 and CVE-2026-109619. Both have a CVSS severity score of 9.2 out of 10, allowing attackers to execute malicious code on vulnerable servers without authentication.
These vulnerabilities were discovered with the help of AI research tools and affect PHP, the well-known server-side programming language that powers approximately 69% of websites.
The FBI urges organizations to apply patches or go offline.
The FBI’s cyber division warned that these vulnerabilities could allow cybercriminals to remotely execute code, thereby exposing sensitive data and networks. The agency urged organizations to immediately install available updates or take affected systems offline.
The United States, the United Kingdom, and Japan have also urged website owners to install security updates or take affected systems offline.
Japanese Prime Minister Kashiwagi Sanae also urged website operators to check their PHP systems.
This reaction shows that once attackers learn how to exploit vulnerabilities in widely used software, these flaws quickly evolve into significant security risks.
What else happened in the past 48 hours?
As PHP warnings emerged, external attention remained focused on other serious security incidents: GitLab disclosed a vulnerability with the highest severity rating of 10 out of 10, and LiteLLM was reportedly containing code designed to steal passwords.
Other reports indicate that hackers used AI tools to attack over 1,200 websites and more than 100 companies, including John Deere and Cummins.
Additionally, India’s eMudhra has been exposed to serious security vulnerabilities, with eight intermediate certificate keys found to be excessively weak. One was reportedly set to the number 4, raising concerns about the security of its 60 million+ certificates.
Meanwhile, the State Bank of India (SBI) confirmed that 3,897 customer records appeared on the dark web.
What should you actually do today?
Organizations or encrypted users should check whether their trading bots, AI agents, or external platforms may be affected by these security incidents. Affected PHP versions should be updated with official security patches, and signs of compromise should be investigated.
Cloudflare has also deployed protective rules for customers using its web application firewall, but stated that patching is still necessary.
Was this article helpful?
Trust CoinPedia:
CoinPedia has been providing accurate and timely updates on cryptocurrencies and blockchain since 2017. All content is created by our team of expert analysts and journalists, following strict editorial guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Each article is fact-checked against reliable sources to ensure accuracy, transparency, and reliability. Our review policy ensures impartial evaluations when recommending exchanges, platforms, or tools. We are committed to keeping all information in the cryptocurrency and blockchain space up to date, from startups to industry giants.
Investment Disclaimer:
All opinions and insights shared in this article represent the author's personal views on the current market conditions. Please conduct your own research before making any investment decisions. Neither the author nor the publisher assumes responsibility for your financial choices.
Sponsorship and Advertising:
This site may contain sponsored content and affiliate links. Ads will be clearly labeled, and our editorial content remains independent of our advertising partners.