What happened?

Cloudflare said exploitation attempts targeting two critical PHP vulnerabilities have climbed into the millions. The company added that it is blocking the attacks across all of its plans, including the free tier.

A call to users

Cloudflare's message is clear: network-level protection alone is not enough. Site administrators need to update their PHP installations urgently. Until the flaws are patched, the attack surface stays open.

Why it matters

PHP underpins a large share of the web. Flaws like these put not just a single site at risk but thousands of services sharing the same infrastructure. Cloudflare's scaled protection acts as a temporary safety net for sites that haven't patched yet.

What to do

  • Upgrade your PHP version to the patched release as soon as possible.
  • Check system logs after updating.
  • Add a web application firewall (WAF) layer where possible.