Cloudflare seems to see millions of exploit attempts on AI-found PHP flaws as cyber agencies urge sites to patch fast or go offline

Two flaws deep inside PHP, the programming language behind a large share of the web, seem to have drawn a fast wave of attack traffic after their fixes went public on Wednesday, Oct. 21. Cloudflare CEO Matthew Prince said in a post on X late Wednesday: “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Reuters reports in a story carried by CNA and The Straits Times. This desk did not read the X post itself. An attempt to exploit a flaw does not mean a site got broken into; The Hacker News, in an updated report, says: “No source has reported a confirmed break-in of a specific server as of this update.”

The PHP project calls the problem critical. Its security advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 “fix two critical vulnerabilities that can allow unauthenticated remote code execution,” meaning an outsider with no login could run code on a server, and adds: “All PHP users are strongly encouraged to update immediately.” It lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the setups at risk and says: “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” Each release note says: “There are no complete mitigations, updating is the only safe choice.” A PHP notice posted a day earlier had scheduled the release for 14:00 UTC on Oct. 21 (7 a.m. PDT) and said both flaws carried a CVSS v4.0 score of 9.2.

The two bugs carry the names CVE-2026-109618 and CVE-2026-109619. PHP’s first GitHub advisory says the first stems from how PHP handles running out of memory: an early exit can leave request memory “in an invalid state,” which the shutdown step may then act on. The second advisory describes leftover state from one request that a later request on the same worker can touch after its memory got freed, “causing a use after free.” Google Cloud says the flaws affect “All versions of PHP from 5.4 through 8.5.11” and that “The PHP project is not releasing fixes for PHP 8.1 or earlier, which have reached end of life.” The Hacker News says the PHP security team published source backports for PHP 7.4, 8.0 and 8.1 for people who build from source.

Government cyber agencies issued warnings the same day, Oct. 21. The U.S. Cybersecurity and Infrastructure Security Agency “strongly urges organizations to immediately patch” and says organizations that cannot update immediately, or that run PHP 8.1 or earlier, “should take PHP-based systems offline until they can be patched or updated.” The UK’s National Cyber Security Centre tells organizations that cannot patch or apply PHP’s temporary mitigations in time that “you should consider taking the system offline until it can be fully mitigated,” and, where a system cannot get updated or disabled right away, to check it for evidence of compromise before the upgrade. The BBC says the U.S. National Security Agency gave similar advice on X, quoting it: “These vulnerabilities often provide a direct path to the server's file system or database.” The BBC also reports that the White House said federal agencies worked with leading AI labs to speed up a fix, and that Japan’s Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP; Reuters reports the same Takaichi appeal.

Many operators took sites offline as a precaution, outlets report. The BBC says Finland temporarily shut down the government’s public web services, the Netherlands’ cyber-security agency took its own website offline, and the Wikimedia Foundation said: “We have taken down a number of other systems as a precautionary measure until they can be safely patched.” In Scotland, at least seven of 32 councils and six of 14 health boards took their websites down at one point on Wednesday evening, a second BBC report says, though some came back later that evening. The Verge lists 4chan, DeviantArt and Wikipedia among the sites with problems and says Pokémon Home and Pokémon Champions went offline, citing Kotaku. Reuters says Mitsubishi UFJ Financial Group temporarily suspended some internet services and Japan’s Finance Ministry suspended some website content and services.

Security firms and government agencies describe the attack picture differently. CISA says: “While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.” Amazon’s threat intelligence team, writing on the AWS Security Blog, says its MadPot honeypots logged an exploitation attempt dating to Oct. 17, four days before disclosure, and that “it remains unclear how the actor acquired exploit information prior to disclosure.” It adds that “PHP2Shell is now being broadly exploited in the wild,” while also saying “it’s unclear if any of these attempts would have succeeded in real-world systems.” The BBC quotes Cloudflare chief technology officer Dane Knecht as “seeing early attacks emerging and are updating mitigations as new vectors show up.”

Artificial intelligence played a central role on the finders’ side, the researchers say. The BBC says researchers at the firms Calif and Wiz found the flaws and that Calif and the PHP Foundation took part in an OpenAI program called Patch the Planet. Wiz says its team found the first PHP flaw on Aug. 19 using “Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol,” reported the bugs to the PHP security team on Aug. 24, and that proving them exploitable “required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” The Verge quotes OpenAI: “We consider this one of the most impactful security issues in recent memory.” Wiz says PHP “powers 70% of all websites in the world”; the BBC says it could not verify Wiz’s “roughly 70%” figure, and The Verge cites W3Techs at 69.3% of sites whose server-side language it knows.

The release came earlier than planned. The BBC says the PHP Foundation had meant to announce the flaws later in October but moved after details leaked on social media on Tuesday. The Hacker News says a post on Hacker News on Oct. 20 claimed disclosure would come on Oct. 22, and that the PHP Foundation later said Calif mistakenly posted a video of its working proof of concept around 20:00 UTC on Oct. 20. The same report says the PHP Foundation called months of stalled work on an earlier-spotted version of the memory bug “a structural failure” of its decision process and resources. Amazon puts the official embargo end at 14:00 UTC on Oct. 21.

For site owners, the agencies and PHP give the same first step: update the PHP runtime. The Hacker News notes that updating an application such as WordPress does not update the PHP version underneath it, which comes from the server package, the host or the container image, and that PHP 8.2 reaches end of life on Dec. 31, 2026. The Verge says people on a managed hosting service should check with their provider on when to expect the fix. For ordinary readers, The Verge says the flaws sit on servers rather than personal devices, though compromised sites could spread malware.