Cloudflare CEO Sounds Alarm as PHP Vulnerability Triggers Wave of Millions of Hacking Attempts
Matthew Prince from Cloudflare reports the company's network detected thousands of exploitation efforts prior to the PHP security flaw becoming public knowledge.
Matthew Prince, who serves as Cloudflare's Chief Executive Officer, issued a warning that the company's network detected millions of attempts to exploit a critical security vulnerability following its public disclosure.
During the 10-hour window preceding the public announcement of the PHP security flaw, the network recorded thousands of attempts to exploit it, a number that has since escalated to "millions," according to Prince's statement posted on X Thursday.
As an internet infrastructure provider, Cloudflare offers services that enhance website loading speeds and provide protection against various forms of cyberattacks. The company reports that approximately one out of every five websites across the globe directs its traffic through Cloudflare's network infrastructure.
The PHP Foundation confirmed on Wednesday that limited resources contributed to a delay in addressing a critical security vulnerability that was initially discovered in 2024, subsequently releasing emergency security patches to address two critical flaws.
This security flaw creates a potential pathway for threat actors to distribute malicious software or insert harmful scripts into websites operating globally. Data from W3Techs, a web technology research service, indicates that PHP serves as the foundation for approximately 69% of all websites that utilize a known server-side programming language.
According to a Wednesday post on X from the FBI's Cyber Division, these two critical security vulnerabilities could potentially "allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks." The agency strongly recommended that organizations either implement an immediate security update or temporarily take their systems offline.
As a protective measure on Wednesday, numerous organizations and government agencies made the decision to take their websites offline temporarily.