Cloudflare CEO Says PHP2Shell Exploit Attempts Hit Millions as Government and Wikipedia Services Go Offline

Since federal agencies told organizations on Oct. 21 to patch two critical PHP flaws or take their servers offline, the scale of the response and the speed of the attacks have come into focus. Government sites in Europe went dark, parts of Wikipedia and 4chan came down, and Cloudflare's CEO said exploit attempts reached the millions within hours of disclosure.

Attacks ramped up within minutes of disclosure

Matthew Prince, Cloudflare's CEO, laid out the timeline on X. His company saw thousands of exploit attempts in the 10 hours before the flaws were announced publicly. That "jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," he wrote.

That is attempts, not successful break-ins. No one has published a count of compromised sites.

The flaws, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, would let an attacker run code on a vulnerable server without a password or any other credentials. From there, an attacker could take over a site, steal sensitive data or tamper with content. Cloudflare said the bugs could also be used to disrupt services and expose customer data.

PHP is open-source and runs on roughly 70% of websites that use a known server-side language, according to Ismael Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf. He added that this "doesn't mean all websites are vulnerable," but said the flaws demand "immediate attention."

Sites that went dark

The Finnish government's website was only partly available Wednesday. A notice told visitors that government sites were "experiencing a temporary disruption" while the issue was resolved. Other European government sites also went offline, and certain Wikipedia services and 4chan were pulled until they could be patched.

The FBI's cyber division warned that the bugs could allow remote code execution, putting data and networks at risk. It recommended operators take sites offline if they could not update immediately. Officials from the U.S. to Japan issued similar warnings.

The PHP Foundation released fixes Wednesday, along with update instructions.

How the bugs were found

The flaws were found with AI models. OpenAI said in a blog post that it led a coalition of researchers and security providers over the past two months. It said PHP's maintainers led the fixes and release, with help from partners including Wiz and Cloudflare.

Researchers at Wiz, now owned by Google, used Google's Gemini 4 Argon, Wiz Atlas and OpenAI's GPT-5.6 Sol. The security firm Calif also took part. The bugs were found in late August and held back until a fix was ready.

"With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work," Wiz researchers wrote. They said the flaws had sat in the code for decades because proving them exploitable took "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." AI lowered that barrier.

Wiz called the findings "among the most severe vulnerabilities discovered in PHP, and arguably in software history." Its researchers compared the episode to Heartbleed, the 2014 encryption bug that affected a technology used by an estimated two-thirds of the web.

OpenAI called the flaws "one of the most impactful security issues in recent memory." It said AI appeared to find them before any attackers did, and that they are "among several significant vulnerabilities we've already found and are working to fix." The company added: "we expect similar findings to increase sharply in the coming months."

The double edge

The same capability cuts both ways, and OpenAI says so itself. "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits," the company wrote.

Skepticism about AI-generated bug reports has been common among security researchers, many of whom have seen such reports turn out to be minor issues or false alarms. This disclosure involves confirmed, patched, remote-code-execution flaws in core PHP. That is a different class of finding from the low-grade reports critics complained about.

The disclosure also exposes a structural weakness. A huge share of the web rests on open-source code maintained largely by volunteers. In this case a small coalition spent two months preparing a fix. Millions of attempts followed within hours of the announcement.

What comes next

Defenders are bracing for a wave of intrusions over the coming weeks, as attackers go after servers that have not been updated. The PHP Foundation's patch is the only complete remedy. Operators who cannot apply it immediately face the federal choice: disconnect or accept the risk.

Still unanswered is how many servers remain unpatched and how many were breached before fixes went in. Cloudflare's attempt counts are the only public measure so far.