Cloudflare reports millions of potential cyberattacks as it's forced to fix 'critical' security flaw

If you thought the internet felt a bit sluggish yesterday (October 21), it may be because a PHP patch update was released to fix two critical flaws rated 9.2 out of 10 in terms of severity.

Cybersecurity organizations around the world issued their own advice, and in anticipation of potential attacks, whole corners of the internet started going offline.

It's thought that up to 75% of the internet is run on websites using the PHP programming language, which runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to our devices.

While we were told to prioritize internet-facing systems, and older versions of PHP were most at risk, all were at risk. Maybe we should've followed in the footsteps of the Dutch government pulling down numerous websites, because according to Cloudflare, it's been forced to deal with millions of cybersecurity exploit attempts.

What has Cloudflare said about the PHP update?

Taking to X, Cloudflare CEO Matthew Prince confirmed our worst fears that various bad actors could exploit potential vulnerabilities in the PHP patches.

UNILADTech already spoke to full-stack engineer David Erichsen, who warned that the update could lead to wider security risks where hackers could steal customer data, distribute card skimmers on checkout pages, or add hidden backdoors that would survive the patch.

In the aftermath of the chaos, Prince wrote: "In the 10 hours before it was publicly announced, ​across the network we saw thousands of attempts ​to exploit it. That jumped to tens of ⁠thousands in the 45 minutes post announcement, hundreds ​of thousands within 2 hours, and millions now."

PHP developers suggested that some vulnerabilities have been lurking in software for 'years' until AI uncovered them, telling users to immediately update.

While countries in Europe tried to get ahead of the game by going offline ahead of time, this has spread to other corners of the world.

In particular, Japanese Prime Minister Sanae Takaichi asked ​website owners to check which of their sites used PHP and to ensure they were updated accordingly.

Japan's Finance Ministry suspended some websites, while Japanese lender Mitsubishi ​UFJ Financial Group said it was suspending some measures due to emergency measures.

What is Cloudflare's php2shell vulnerability?

In a blog, Cloudflare confirmed it is acting now and highlighted how all web servers running PHP 5.4 or later were affected. With attackers able to cause a denial of service, execute remote code, and expose data, Cloudflare said it's been part of a joint effort with PHP foundation, OpenAI, Wiz, and others by deploying web application firewall (WAF) protections since the start of October 2026.

Putting our fears at rest somewhat, Cloudflare said this was deployed around nine hours ahead of public disclosure.

Whether using free or paid WAF, all Cloudflare customers have been protected by default against php2shell.

It reiterated that it deployed 'multiple mitigations' for all customers after the vulnerability was leaked before an official release date because it observed 'attack traffic’ targeting customers.

Cloudflare reminds us that php2shell vulnerabilities affect the PHP runtime itself, with protection requiring more than standard request-based rules.

Even though WAF protections provide an extra layer of defense, customers are still told to patch their PHP repos.

Cloudflare's security analysts will continue monitoring attack activity and will update rules when/if new attacks emerge.