Cloudflare CEO Matthew Prince said its network saw thousands of exploit attempts in the 10 hours before a critical PHP vulnerability was disclosed, and that the count later reached millions. The source does not say the attempts succeeded.
The PHP Foundation acknowledged that limited resources had delayed a fix for a critical flaw first identified in 2024, and released emergency patches for two critical vulnerabilities. The FBI warned that the two flaws may let attackers run code remotely, potentially exposing data and networks, and urged organizations to update immediately or take their systems offline. Multiple organizations and government agencies took websites offline as a precaution.
