PHP vulnerabilities trigger millions of exploit attempts, Cloudflare says
Sundry Photography
Cloudflare (NET) detected millions of attempts to exploit critical vulnerabilities in the widely used PHP programming language, CEO Matthew Prince said in a post on X late Wednesday, as government websites and online services were taken offline amid a global security response.
"In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now." Prince said.
PHP, a programming language used to run websites, has two vulnerabilities, collectively dubbed PHP2Shell, that could let hackers run malicious code on affected servers, potentially exposing data or disrupting websites.
Cloudflare (NET) said it deployed protections about nine hours before public disclosure to block suspicious traffic. The safeguards are available to customers with their web application firewall enabled, including free-plan users.
The disclosure prompted emergency measures worldwide, with some government websites in Europe and elsewhere going offline. Japan’s Mitsubishi UFJ Financial Group (MUFG) temporarily suspended some internet services, while the country’s Finance Ministry took some website content and services offline. Prime Minister Sanae Takaichi urged website operators to check for PHP and prepare to install security fixes.
Register for free to keep reading.
Create a free account to get unlimited breaking news and alerts when your stocks move.
KioskNews shows a cleaned-up reading view extracted from the publisher’s page — the original always lives on their site, not ours.