A critical security flaw in PHP has triggered millions of hacking attempts, raising concerns about websites and user data worldwide. Cloudflare CEO Matthew Prince warned that attacks surged after two flaws became public.
The FBI and other cybersecurity agencies are urging website owners to install security updates immediately or take affected websites offline until they are safe.
PHP Vulnerabilities Trigger Millions of Attacks
In a recent tweet on X, Cloudflare CEO Matthew Prince said the company’s network had seen thousands of exploit attempts in the 10 hours before the vulnerabilities were disclosed.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
The two vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS severity score of 9.2 out of 10 and can allow attackers to run malicious code on vulnerable servers without logging in.
The flaws were discovered with help from AI research tools and affect PHP, which powers around 69% of websites, a known server-side programming language.
FBI Urges Organizations to Patch or Go Offline
The FBI’s Cyber Division warned that the vulnerabilities could let cybercriminals execute code remotely, potentially exposing sensitive data and networks. It urged organizations to install the available updates immediately or take affected systems offline.
The US, UK and Japan urged website owners to install security updates or take affected systems offline.
Japan’s Prime Minister Sanae Takaichi also urged website operators to check their PHP systems.
The response shows how quickly a weakness in widely used software can become a major security risk once attackers learn how to exploit it.
What Happened in the Last 48 Hours?
The PHP warning comes amid reports of other serious security incidents. GitLab disclosed a maximum-severity 10/10 vulnerability, while LiteLLM reportedly contained password-stealing code.
Hackers also allegedly used AI tools to attack 1,200-plus websites and over 100 companies, including John Deere and Cummins
There are also reports of serious security concerns involving India’s eMudhra, where eight intermediate certificate keys were found to be weak. One was reportedly set to the number four, raising concerns about the security of its 60 million-plus certificates.
Meanwhile, State Bank of India (SBI) confirmed that 3,897 customer records had appeared on the dark web.
What Should You Actually Do Today?
Organizations or crypto users should check whether their trading bots, AI agents, or external platforms may be affected by these security incidents. Affected PHP versions should install the official security updates and check for signs of compromise.
Cloudflare has also deployed protective rules for customers using its web application firewall, but says patching remains necessary.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
