Cloudflare Detects Millions of Exploitation Attempts of PHP Vulnerability
Cloudflare CEO Matthew Prince stated that after a serious vulnerability was disclosed in the widely used programming language PHP, the company has monitored millions of exploitation attempts.
Prince noted that within 10 hours before the vulnerability was publicly disclosed, thousands of exploitation attempts were detected across the network; this surged to tens of thousands within 45 minutes after the disclosure, reaching hundreds of thousands within two hours, and has now reached millions.
Following the PHP vulnerability disclosure on Wednesday, global website operators took urgent measures, causing some government websites in Europe and other regions to go offline; Japan's Mitsubishi UFJ Financial Group suspended some internet services, and the Japanese Ministry of Finance temporarily halted some website content and services.
PHP developers released an emergency fix on Wednesday, stating that the vulnerability had been lurking for years until it was discovered with the help of AI, and urged all users to update immediately; Japanese Prime Minister Sanae Takaichi urged website owners to check if they are using PHP and prepare to apply the fix.
Cloudflare has pre-deployed WAF mitigation measures and stated that about one-fifth of website traffic goes through its network; PHP is estimated to support about 70% of websites using known server-side languages, and the vulnerability could allow for remote code execution and data exposure.
Exploitation attempts have grown exponentially since the disclosure, with attackers conducting large-scale scans within the repair window; benefiting are sites that have completed updates or deployed protections, while those under pressure are legacy PHP systems and government and enterprise services that rely on the language and have not patched in time.
Source: Public Information
ABAB AI Insight
Matthew Prince has long publicly shared security data at the infrastructure level as a co-founder of Cloudflare, which provides WAF and DDoS protection to clients through large-scale traffic monitoring. He has previously reported the scale of attack attempts after major vulnerability disclosures to illustrate the timeliness of network layer interception.
This time, he highlighted the core data of the leap in exploitation attempts from thousands to millions before and after the disclosure, reflecting resource mobilization as free WAF rules were deployed before the public announcement, and tracking changes in payloads continued after the disclosure. The goal is to compress the "vulnerability disclosure to large-scale scanning" window into observable hours while pushing clients to upgrade PHP immediately.
Similar patterns have been seen in historical vulnerabilities like Log4j and Heartbleed, where exploitation attempts grew exponentially within hours after disclosure, forcing operators to choose between taking systems offline or urgently patching between the release of fixes and the peak of scanning. The current phase is closer to incorporating both long-hidden vulnerabilities discovered with AI and automated exploitation after disclosure into the scope of infrastructure protection.
This represents a shift in technical alternatives and control: core language vulnerabilities that were originally discovered through manual audits are now entering the public exploitation phase after being accelerated by AI, and protective capabilities are shifting from single-site updates to network-layer WAF preemptive interception, with systems that have not been updated in time facing large-scale scanning pressure in a short period.
ABAB News · Cognitive Laws
Exploitation attempts surged from thousands to millions within hours after the vulnerability disclosure
The public window determines the scale of attacks, rather than the vulnerability's lurking time
Network layer protection is a tool to convert single-site repair pressure into observable interception