Critical PHP Flaws Trigger Global Cybersecurity Scramble as Exploit Attempts Hit Millions

Companies and governments worldwide are rushing to secure websites after two critical vulnerabilities were found in PHP, the programming language that powers a large share of the web. Cloudflare reported that attempts to exploit the flaws rose from thousands before public disclosure to millions afterward. The figure counts attempted attacks; it does not mean millions of systems were breached.

Critical Flaws Put Internet-Facing Systems at Risk

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could let an attacker send a specially crafted request to a vulnerable server and run malicious code without logging in. The PHP development team released security updates on October 21 and urged users to install them. European cybersecurity authorities have also called on organizations to act quickly, prioritizing systems exposed to the internet.

PHP runs behind many widely used websites and applications, including platforms such as WordPress and Magento. Cloudflare estimates that PHP is used by almost 70% of websites. Because the vulnerabilities affect the PHP runtime, updating a website’s theme or plugins alone does not fix the underlying problem. The server’s PHP software must be patched by whoever manages it, which may be the site owner or hosting provider.

Websites Taken Offline as a Precaution

The response has already disrupted online services. Government websites in Finland were temporarily shut down while security updates were applied. Finland’s state IT provider said the outage was a precaution and that it had no indication the vulnerabilities had been exploited in a breach. Services were being restored after patches were installed and tested.

Also Read: Stocks to Watch Today: October 23, 2026 – Infosys, BPCL, JSW Steel, Coforge and More

In Japan, companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily suspended some online services. Government agencies also restricted parts of their websites as they reviewed systems and applied updates. French telecoms group Orange said it had suspended access to certain PHP-based websites and applications as a precaution. These interruptions reflect protective measures; they are not, by themselves, evidence of successful attacks.

Why the Vulnerabilities Matter

The affected flaws involve how PHP handles memory when a request fails. Under certain conditions, that can expose information, disrupt a service or allow code to run on a vulnerable server. The PHP team released fixes for supported branches, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The team said updating is the only complete fix.

Cloudflare CEO Matthew Prince said the company observed thousands of attempts in the ten hours before public disclosure, followed by tens of thousands shortly afterward, hundreds of thousands within two hours and millions by the time of his update. The rapid increase shows how quickly attackers can begin probing a widely used software flaw once details become available. It does not establish how many attempts reached vulnerable systems or succeeded.

Global Response Continues

The disclosures followed coordinated research involving security companies and researchers. The PHP Foundation said the vulnerabilities had been known since at least 2024 and acknowledged weaknesses in how the issue was handled. The episode has renewed attention on the challenge of maintaining software that supports essential services across government, finance, transport and business.

Also Read: S&P 500 Today, October 22, 2026: Nasdaq Slides as Meta Earnings and Rising Oil Pressure Wall Street

Installing a patch does not always mean a service can immediately return. Operators need to check which systems use PHP, apply the correct update and test that websites and connected services still work. Finland’s IT provider warned that restoring some services could take days or weeks because systems need careful testing.

The immediate concern is the gap between public disclosure of a serious flaw and the time every affected system is updated. The spike in exploit attempts has put pressure on hosting companies, public agencies and businesses to identify exposed systems and close that gap. At the time of reporting, the confirmed incidents included precautionary service suspensions; the millions of attempts reported by Cloudflare should not be mistaken for millions of confirmed breaches.

Disclaimer: This article is for informational purposes only and is not investment advice. Onetrader is not registered with SEBI as an investment adviser or research analyst.