Cloudflare Reports Millions of Hacking Attempts After PHP Vulnerabilities Emerge

Cloudflare has reported millions of hacking attempts targeting vulnerabilities in PHP, the widely used programming language that powers a substantial portion of websites and online services. The attacks escalated rapidly following the public disclosure of the flaws, according to a Reuters report published on October 22, 2026. What began as a smaller number of exploitation attempts reportedly grew into millions within hours, highlighting how quickly cybercriminals can exploit newly disclosed weaknesses. The situation triggered an urgent response from organisations that rely on PHP-based systems, including businesses, financial institutions and government agencies. The incident also renewed concerns about the time between discovering a software vulnerability, publicly announcing it and ensuring that affected systems have been updated.

The vulnerabilities have created particular concern because PHP remains an important part of the internet’s underlying infrastructure. Websites built with PHP can support online shopping, banking services, content management systems and government platforms. When a vulnerability affects widely deployed software, attackers can potentially scan large numbers of internet-connected systems to identify those that have not been patched. According to the report, security teams observed a sharp increase in exploitation attempts after details of the PHP flaws became public. The episode demonstrates how quickly technical information about a software weakness can be turned into automated attacks, especially when criminals use scanning tools to search for vulnerable systems across multiple countries.

The disclosure also prompted organisations in several countries to take precautionary measures. Reuters reported that businesses and public institutions, including organisations in Japan and Finland, temporarily suspended some services while implementing updates and reviewing their security. Financial and transport-related organisations were among those affected by the precautionary response. However, not every interruption indicated that a successful cyberattack had occurred. Finland’s state IT agency reportedly said that certain service disruptions were precautionary measures rather than evidence of exploitation. The distinction is important because shutting down a vulnerable service can help prevent an attack, even when there is no confirmation that an intruder has gained access to the system.

The incident has also highlighted the growing role of artificial intelligence in cybersecurity. According to the report, AI was involved in identifying the software weaknesses that led to the disclosure. AI-assisted security tools can help researchers analyse code, identify unusual patterns and discover vulnerabilities more quickly than traditional manual methods in some circumstances. However, the same capabilities can create risks when details of a vulnerability become available before organisations have completed their security updates. Attackers may use automation to examine systems at scale and attempt to exploit weaknesses before administrators can respond. The latest incident illustrates the importance of coordinating vulnerability disclosure with software fixes, particularly when the affected technology is used across critical industries.

Security experts generally recommend that organisations prioritise installing verified security updates, identifying internet-facing systems that use vulnerable software and monitoring networks for suspicious activity. Businesses should also maintain reliable backups, restrict unnecessary access to servers and establish incident-response procedures before emergencies occur. For website owners, the first step is to determine whether their systems use an affected PHP version and apply the appropriate vendor-recommended updates. Organisations that cannot immediately patch a system may need to consider temporary protective measures while assessing their exposure. Although the full long-term impact of the latest wave of attacks remains uncertain, the incident is a reminder that software security depends on rapid coordination between developers, hosting providers, businesses and public authorities.