Cloudflare Deploys Fix for PHP Flaws Threatening 70% of Sites as Early Attacks Emerge

The organization responsible for monitoring the PHP programming language issued a severe warning on Tuesday regarding two identified cybersecurity vulnerabilities. These flaws are significant because PHP is a free, open-source language that underpins much of the web infrastructure. The agency stated that fixes were scheduled for deployment on Wednesday at 10 a.m. ET, though experts are urging immediate attention from administrators.

What is the scope of the exposure?

According to the Wall Street Journal, these vulnerabilities could affect approximately 70% of the world’s websites. The warnings issued by the PHP group are described as unusually severe. The exploit associated with these flaws has been dubbed “PHP2Shell.” This high potential impact rate means that a vast majority of web properties built on this language are potentially at risk if they have not applied the necessary updates.

How were these flaws discovered?

The vulnerabilities were identified using artificial intelligence tools. This method of discovery highlights the evolving landscape of security research, where automated systems are increasingly used to find weaknesses in widely used software. The PHP monitoring agency confirmed the identification of these two major issues, prompting the severe warning to the broader community of developers and system administrators who rely on this programming language for their web services.

Are attackers already exploiting these issues?

Security officials are urging website administrators to download new updates with patches immediately. Cloudflare’s chief technology officer, Dane Knecht, said on Wednesday morning that his company has deployed a fix. However, Knecht noted that the company is still seeing early attacks emerging. This indicates that threat actors are actively probing for systems that have not yet been patched, making rapid response critical for organizations running PHP-based services.

What is the current status of the fix?

Fixes were scheduled to be deployed on Wednesday at 10 a.m. ET. While Cloudflare has already implemented a solution, the situation remains a developing story. Security experts continue to urge administrators to take immediate notice and precautions. Organizations should verify whether their specific environments have received the updates and monitor for any unusual activity that might indicate an attempt to exploit the PHP2Shell vulnerability.

Questions to ask your suppliers

Teams should ask vendors if their PHP-based services include the latest security patches. Determine who is responsible for applying updates to shared hosting or managed platforms. Check whether the supplier has a process for rapid deployment of critical fixes. Identify the contact point for urgent security alerts. Ensure that internal teams are notified of any changes to the security posture. Verify that logging mechanisms are active to detect potential exploitation attempts. Confirm that backup procedures are current in case remediation requires a rollback.

What to do and how to stay safe: PHP

• Verify that your web servers and applications are running the updated version of PHP with the security patches.
• Monitor server logs for unusual activity or signs of exploitation, particularly those related to the PHP2Shell exploit.
• Contact your hosting provider or cloud vendor to confirm they have applied the necessary fixes to their infrastructure.
• Review access controls and ensure that only authorized personnel can make changes to server configurations.

Step-by-step guide: Browser Security Settings for Small Business Teams

General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many websites are potentially affected by these PHP vulnerabilities?

According to the Wall Street Journal, up to 70% of the world’s websites could be affected by these flaws.

Who discovered these vulnerabilities?

The vulnerabilities were identified by artificial intelligence, as reported by the PHP monitoring agency.

Has Cloudflare fixed the issue?

Yes, Cloudflare’s CTO Dane Knecht stated that the company has deployed a fix, though early attacks are still being seen.