Cloudflare has recorded millions of attempts to exploit two critical PHP vulnerabilities since details became public on Wednesday, according to CEO Matthew Prince. The flaws affect PHP, a widely used programming language that powers a large portion of the web, prompting organizations worldwide to scramble for security fixes.
Key takeaways
- Cloudflare saw millions of exploit attempts across its network after vulnerability details leaked online.
- PHP rated both flaws 9.2 out of severity and released emergency patches for versions 8.2 to 8.5.
- AI tools from companies like OpenAI helped security firms identify the flaws.
- Organisations in Europe and Japan temporarily took websites offline to apply security measures.
What risks do these PHP vulnerabilities pose to servers?
The vulnerabilities, known as PHP2Shell, let attackers run code on a web server without needing to log in. Because of this high risk, PHP rated both flaws 9.2 out of 10 for severity. The organization released emergency patches on Wednesday for versions 8.2 through 8.5, launching the updates a day ahead of schedule following an online data leak. Security firms Wiz and Calif, along with OpenAI, reported that AI tools assisted in identifying the issues.
Prince shared attack statistics on X late Wednesday. According to The Next Web, Cloudflare noted thousands of exploit attempts during the 10 hours before the public disclosure. That number jumped to tens of thousands within 45 minutes, reached hundreds of thousands within two hours, and grew to millions soon after.
How are organizations responding to the security updates?
Cloudflare activated firewall rules for all customers, including free tier users, roughly nine hours before the public announcement. Even so, the company warned that these rules provide only temporary protection and cannot replace the required software updates. PHP strongly urged all users to install the patches immediately.
The threat forced organisations globally to pull services offline. CERT-EU warned that unpatched sites might need to go dark to prevent attacks, causing several European government websites to shut down temporarily on Wednesday. Reuters reported that Japan's Mitsubishi UFJ Financial Group suspended certain internet services as a precaution, while the country's Finance Ministry halted select website content. Prime Minister Sanae Takaichi advised website operators to verify if their systems use PHP and prepare for patching.
What happens next for unpatched systems?
Operators running PHP versions older than 8.2 face a severe hurdle because those older releases no longer receive official support. These administrators must depend on third-party software vendors or hosting providers for assistance, leaving them with limited choices to secure vulnerable systems against ongoing attacks.
Need help moving off old PHP?
If your site runs PHP 8.1 or older, it cannot get the PHP2Shell fix. We upgrade it to a patched PHP 8.4 in 7 days: PHP 5.6, PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 to PHP 8.4. On PHP 8.2 or 8.3, patch now and plan the PHP 8.2 or PHP 8.3 to 8.4 upgrade.
Rather leave old PHP code behind? See our PHP to Laravel, PHP to Node.js and PHP to Python migrations, or move an online store with PHP to Shopify.
Frequently asked questions
The vulnerabilities are two critical flaws in PHP that allow attackers to execute code on a web server without logging in. PHP rated both flaws 9.2 out of 10 for severity.
PHP released emergency patches for versions 8.2 through 8.5 on Wednesday, a day ahead of schedule after technical details leaked online.
According to CEO Matthew Prince, Cloudflare saw thousands of attempts before disclosure, which quickly jumped to tens of thousands, hundreds of thousands, and eventually millions of attempts.
Cloudflare enabled firewall rules for all customers, including free plans, about nine hours before the disclosure, though the company warned this protection is only temporary.
Versions older than 8.2 no longer receive official support, meaning operators must rely on vendors or hosting providers for patches to secure their outdated systems.
Based on reporting by The Next Web. Read the original article
