By PYMNTS | October 22, 2026
Cloudflare reported millions of attempts to exploit newly disclosed vulnerabilities in PHP, or Hypertext Preprocessor, as companies and governments raced to secure websites and online services built on the widely used programming language.
Cloudflare Chief Executive Matthew Prince described the rapid escalation in a post on X late Wednesday (Oct. 21), according to Reuters. The company recorded thousands of attempted exploits in the 10 hours before the vulnerabilities were publicly disclosed. That number climbed to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and millions thereafter.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
PHP developers released emergency security updates Wednesday and urged users to install them immediately. The vulnerabilities had remained undetected for years before researchers identified them with the help of artificial intelligence tools, Reuters reported.
The disclosure prompted organizations across several countries to suspend some online services as a precaution while security teams worked to apply fixes. The affected systems included banking, transportation, tax and government services, illustrating the software’s broad reach across public and private infrastructure.
In Japan, Mitsubishi UFJ Financial Group, brokerage Nomura, airline ANA and East Japan Railway said they were temporarily suspending certain internet services as part of emergency measures. Japan’s Finance Ministry also restricted some online services while implementing security precautions.
French telecommunications company Orange temporarily blocked access to certain PHP-based websites and applications across several subsidiaries. Finland’s state IT services provider Valtori, which had shut down public government websites, said it was gradually restoring services as security updates were installed.
Governments also stepped up their responses. China’s industry ministry urged organizations to inspect their systems, install secure PHP versions and strengthen cybersecurity monitoring. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures.
The incident underscores the challenge organizations face in maintaining complex technology environments. While larger operators may be able to deploy security patches quickly, companies running older systems or unsupported PHP versions could require more extensive upgrades before they can safely restore services, Reuters reported.