Internet Security Alert: PHP Flaws Draw Millions of Attacks in Hours

A critical security flaw in PHP has triggered millions of hacking attempts, raising concerns about websites and user data worldwide. Cloudflare CEO Matthew Prince warned that attacks surged after two flaws became public. 

The FBI and other cybersecurity agencies are urging website owners to install security updates immediately or take affected websites offline until they are safe.

PHP Vulnerabilities Trigger Millions of Attacks

In a recent tweet on X, Cloudflare CEO Matthew Prince said the company’s network had seen thousands of exploit attempts in the 10 hours before the vulnerabilities were disclosed. 

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

The two vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS severity score of 9.2 out of 10 and can allow attackers to run malicious code on vulnerable servers without logging in.

The flaws were discovered with help from AI research tools and affect PHP, which powers around 69% of websites, a known server-side programming language.

FBI Urges Organizations to Patch or Go Offline

The FBI’s Cyber Division warned that the vulnerabilities could let cybercriminals execute code remotely, potentially exposing sensitive data and networks. It urged organizations to install the available updates immediately or take affected systems offline.

The US, UK and Japan urged website owners to install security updates or take affected systems offline. 

Japan’s Prime Minister Sanae Takaichi also urged website operators to check their PHP systems.

The response shows how quickly a weakness in widely used software can become a major security risk once attackers learn how to exploit it.

What Happened in the Last 48 Hours?

The PHP warning comes amid reports of other serious security incidents. GitLab disclosed a maximum-severity 10/10 vulnerability, while LiteLLM reportedly contained password-stealing code. 

Hackers also allegedly used AI tools to attack 1,200-plus websites and over 100 companies, including John Deere and Cummins

There are also reports of serious security concerns involving India’s eMudhra, where eight intermediate certificate keys were found to be weak. One was reportedly set to the number four, raising concerns about the security of its 60 million-plus certificates. 

Meanwhile, State Bank of India (SBI) confirmed that 3,897 customer records had appeared on the dark web.

What Should You Actually Do Today?

Organizations or crypto users should check whether their trading bots, AI agents, or external platforms may be affected by these security incidents. Affected PHP versions should install the official security updates and check for signs of compromise. 

Cloudflare has also deployed protective rules for customers using its web application firewall, but says patching remains necessary.