Critical PHP Vulnerabilities Trigger Millions of Global Exploit Attempts, Cloudflare Reports

Critical security flaws in the PHP programming language have led to millions of exploitation attempts globally, affecting government websites in Europe and prompting emergency suspensions of digital services by major institutions, including Japan's Mitsubishi UFJ Financial Group and the Ministry of Finance.

Cloud services firm Cloudflare recorded millions of exploitation attempts following the public disclosure of critical vulnerabilities in the widely used programming language PHP, according to CEO Matthew Prince.

Writing in a post on X late on Wednesday, Prince detailed the rapid escalation of malicious activity targeting the software. In the 10 hours prior to the public announcement, the Cloudflare network registered thousands of exploit attempts. This figure surged to tens of thousands within 45 minutes of the disclosure, reached hundreds of thousands within two hours, and subsequently scaled to millions.

The disclosure forced website operators worldwide to scramble to protect their systems. Government websites in Europe and other regions went offline on Wednesday as a direct result of the security flaws. In Japan, Prime Minister Sanae Takaichi urged website owners to verify whether their sites use PHP and prepare to apply emergency patches.

Major Japanese financial and governmental institutions also felt the operational impact. Mitsubishi UFJ Financial Group announced the temporary suspension of some internet services due to emergency security measures. Additionally, Japan's Finance Ministry temporarily suspended specific website content and services while implementing necessary protections.

Developers of the PHP programming language released urgent software fixes on Wednesday to address the vulnerabilities, which had reportedly remained undiscovered in the software for years before being uncovered using artificial intelligence. PHP developers have strongly encouraged all users to update their systems immediately.

"This incident highlights the critical importance of robust infrastructure security and rapid response protocols for digital businesses globally. When foundational technologies like PHP face sudden, critical vulnerabilities, organizations must act immediately to deploy patches and safeguard their systems. For startups and growing enterprises, this serves as a sharp reminder that cybersecurity cannot be an afterthought, and maintaining agile development pipelines is essential to mitigating unforeseen operational risks." — Dr. Shishir Gupta, Founder & CEO, StartupLanes