Critical PHP flaw exploited en masse hours after disclosure, Cloudflare says

What happened

On Wednesday (the 21st), PHP developers publicly disclosed critical vulnerabilities that, according to Reuters via Economic Times, had been hidden in the language's code for years. They were only discovered now because they were identified using artificial intelligence. Maintainers released emergency fixes the same day and advised all users to update immediately.

The speed of exploitation drew attention. Cloudflare CEO Matthew Prince posted on his X account a snapshot of the escalation in attacks observed on the company's network in the hours around the announcement.

In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

Matthew Prince, CEO of Cloudflare

The detail that matters most to infrastructure operators: exploitation attempts already existed before the public disclosure became official, which suggests either an information leak about the flaw or automated scanning of patches in repositories ahead of the formal announcement.

Who has already been affected

The impact wasn't confined to security theory. Government websites in Europe went offline on Wednesday after the disclosure, according to the report. In Japan, the institutional response was fast and visible:

• Mitsubishi UFJ Financial Group bank temporarily suspended some internet banking services as an emergency measure.
• Japan's Ministry of Finance also temporarily suspended content and services on its website while applying security measures.
• Japanese Prime Minister Sanae Takaichi publicly asked website operators to check whether they use PHP and prepare to apply the fix.

A prime minister publicly commenting on a programming language patch is a sign of scale: PHP's installed base underpins a significant share of the web infrastructure of banks, governments, and retailers practically everywhere in the world, Brazil included.

What the source doesn't say (and why it matters)

The report doesn't include the CVE number, the list of affected versions, or the version number carrying the fix. That's a real gap, not a minor detail: without the CVE, security teams can't automate dependency scanning or precisely confirm whether their environment is exposed.

In practice, this means the first step for any team running PHP in production today isn't to apply a specific patch, but rather to check the official announcement from the PHP team (php.net) and the changelogs of their own distribution or package manager (apt, dnf, or the container base image) to identify the exact version released.

What to do if you run PHP in production

With the information available so far, the recommended sequence of actions for anyone maintaining PHP applications in production is as follows:

1. Check the PHP version in use across all environments (production, staging, CI/CD, and versioned container images).
2. Check the official announcement on php.net and apply the security update as soon as it's identified for your version branch.
3. Review access logs for anomalous request patterns, since Cloudflare recorded active exploitation at large scale even before the public announcement.
4. If you use a WAF or CDN with mitigation rules for the flaw, enable those rules as an additional layer while the patch is tested and deployed.
5. Prioritize systems directly exposed to the internet (admin panels, public APIs, institutional websites) in the update queue.

In short: the urgency here isn't security-vendor rhetoric. This is a case where banks and government ministries have already taken services offline as a precaution, and telemetry from one of the world's largest networks shows mass exploitation in the first hours after disclosure.

The angle that remains open

The discovery of the flaw via artificial intelligence, mentioned in passing in the report, is a detail that deserves separate follow-up: it means automated analysis tools are finding vulnerabilities that escaped years of human review in a mature, widely audited project like PHP.

This has two possible readings for developers: on one hand, more eyes (including artificial ones) on legacy code tends to reduce the stock of unknown flaws over time; on the other, the same technique that found the flaw in order to fix it could be used by attackers to find the next one before responsible disclosure. None of the sources available so far detail which tool or AI method was used in the discovery, so this point remains an open question, not an answer.