GBAF Logo
Global Banking & Finance Awards® 2026 Nominations open, free to enter Nominate now →
Cloudflare sees millions of exploit attempts after PHP disclosure - Finance news and analysis from Global Banking & Finance Review
Finance

Cloudflare sees millions of exploit attempts after PHP disclosure

Published by Global Banking & Finance Review

Posted on October 22, 2026

2 min read

· Last updated: October 22, 2026

Add as preferred source on Google

Millions of Exploit Attempts Target PHP Vulnerabilities, Cloudflare Warns

Cloudflare Observes Surge in PHP Exploit Attempts Following Vulnerability Disclosure

Timeline of Exploit Attempts

Oct 21 (Reuters) - Cloud services firm Cloudflare saw millions of exploitation attempts after the public disclosure of critical vulnerabilities in the widely used programming language PHP, CEO Matthew Prince said in a post on X late on Wednesday. 

"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," Prince said. 

Global Impact on Government and Financial Institutions

Government Websites Affected

Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of vulnerabilities in PHP sent website operators around the world scrambling to protect their systems.

Financial Sector Response

Japanese Lender's Emergency Measures

Japanese lender Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services due to emergency measures. 

PHP Developers and Government Urge Immediate Action

Urgent Fixes Released

Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

Government Advisories

Japanese Prime Minister Sanae Takaichi also urged website owners on Wednesday to check whether their sites use PHP and prepare to apply the new fix. 

Japan's Finance Ministry also temporarily suspended some website content and services while security measures were being implemented. 

Reporting Credits

(Reporting by Akanksha Khushi in Bengaluru and Raphael Satter; Additional reporting by Devika Nair and Mariko Katsumura; editing by Lincoln Feast.)

Key Takeaways

  • Cloudflare observed escalation from thousands of tests pre‑disclosure to millions post‑disclosure on Oct 21, per CEO Matthew Prince and other reports.
  • The PHP2Shell flaws affect PHP versions 5.4 onward and were discovered using AI (e.g., OpenAI’s GPT‑5.6); emergency patches (e.g., PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35) were released immediately.
  • An estimated 22.6 million exposed instances were vulnerable, and Amazon Threat Intelligence identified exploit attempts as early as October 17—well before public disclosure.

Frequently Asked Questions

What triggered the surge in exploit attempts observed by Cloudflare?
Cloudflare reported millions of exploit attempts following the public disclosure of critical vulnerabilities in the PHP programming language.
How did financial institutions react to the PHP vulnerabilities?
Japanese lender Mitsubishi UFJ Financial Group temporarily suspended some internet services to implement emergency security measures.
What actions did PHP developers take after discovering the vulnerabilities?
PHP developers released urgent new security fixes and urged all users to update their software immediately.
How did the PHP vulnerabilities affect government websites?
Government websites in Europe and elsewhere went offline as operators worked to safeguard their systems following the disclosure.
What advice did Japanese authorities give to website owners?
Japanese Prime Minister Sanae Takaichi urged website owners to check if their sites use PHP and to promptly apply the latest security fix.

Tags

Related Articles

More from Finance

Explore more articles in the Finance category