Millions of cyberattack attempts follow global PHP security crisis
Millions of attempts to exploit critical vulnerabilities in PHP have been detected worldwide, just hours after the security flaws prompted governments and major websites to take services offline.
Cloudflare chief executive Matthew Prince said on October 22 that the company had recorded a sharp increase in attempted attacks following the public disclosure of the vulnerabilities.
According to Prince, Cloudflare detected thousands of attempts in the 10 hours before the announcement. That number climbed to tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.
The figures represent exploitation attempts rather than confirmed successful breaches.
Cybersecurity company Palo Alto Networks also identified more than 22.6mn exposed instances potentially vulnerable to the flaws, highlighting the scale of the security risk.
The vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619, can allow attackers to execute malicious code on affected servers without authentication.
Asian governments launch emergency security measures
The latest developments have prompted further action across Asia, following widespread precautionary website shutdowns in Europe on October 21.
South Korea raised its cybersecurity alert level for the private sector and activated emergency response procedures, citing concerns about potential hacking attacks.
China’s Ministry of Industry and Information Technology urged organisations to inspect their systems, install security updates and strengthen monitoring. It also recommended changing passwords and other security credentials.
In Japan, Mitsubishi UFJ Financial Group temporarily suspended some online services while implementing emergency security measures.
The country’s Finance Ministry also restricted access to certain website content and digital services.
Meanwhile, Cloudflare confirmed it had deployed new firewall protections to help block attacks targeting vulnerable websites.
The company said attackers had already begun modifying malicious requests in attempts to bypass its security measures.
Can PHP vulnerabilities be fixed?
The PHP development team released emergency patches on October 21, covering versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Google Cloud has urged customers running affected PHP applications to update their software and redeploy their services.
However, the PHP project is not providing official security fixes for version 8.1 or earlier, leaving operators using unsupported software facing additional work to secure their systems.
Cloudflare warned that firewall protections should not replace software updates.
The attacks follow the discovery of the PHP vulnerabilities using artificial intelligence-assisted security research. Although patches are available, the number of systems successfully compromised remains unclear.
