Millions of Attacks Hit PHP Websites Within Hours, Cloudflare CEO Warns

Cloudflare CEO Matthew Prince has warned that attackers launched millions of exploitation attempts against two newly disclosed critical PHP vulnerabilities within hours of their public disclosure.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10 and could allow attackers to execute malicious code remotely or expose sensitive information.

With PHP powering approximately 70% of websites, the vulnerabilities have raised concerns about widespread exploitation. Developers released security patches on October 21, 2026.

PHP exploitation attempts surged to millions within hours

According to Cloudflare CEO Matthew Prince, attackers began targeting the vulnerabilities even before their public disclosure, with activity increasing rapidly afterward.

Prince shared the following timeline of exploitation attempts:

• 10 hours before disclosure: Thousands of attempts.
• 45 minutes after disclosure: Tens of thousands of attempts.
• Within two hours: Hundreds of thousands of attempts.
• By 9:25 PM New York time: Millions of attempts.

The figures highlight how quickly attackers responded to the disclosure and began scanning for vulnerable systems.

However, these numbers represent exploitation attempts rather than confirmed successful attacks or compromised websites.

Website owners urged to install PHP security updates immediately

Security experts recommend that website administrators apply the latest PHP security updates immediately to prevent potential exploitation.

Organizations should upgrade to one of the following patched PHP versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Administrators who cannot immediately install the updates should consider temporarily taking vulnerable websites offline until they can secure their systems.

The rapid increase in exploitation attempts also highlights the shrinking window between vulnerability disclosure and widespread automated attacks.

In other security news, Microsoft Says Chinese Hackers Used AI to Breach ConnectWise.

Via Neowin