Cloudflare, the cloud services firm supporting thousands of platforms online, said it saw millions of exploitation attempts following the emergence of a PHP critical vulnerability disclosure on Wednesday.

The firm saw thousands of attempts to exploit the vulnerabilities in the 10 hours prior to the public disclosure of the vulnerabilities.

“That jumpted to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” CEO Matthew Prince said on Wednesday.

PHP is a critical technology behind many commonly used website platforms, including WordPress. The vulnerabilities, called PHP2Shell, reached a severity rating of 9.2 out of 10.0. The vulnerability can theoretically alllow threat actors to remotely execute code without authentication.

“With 70 percent of the Internet affected, the impact of PHP2Shell cannot be overstated,” researchers at Wiz wrote

PHP had planned to release fixes in a coordinated disclosure of the vulnerabilities, but instead released the updates Wednesday after the flaws were leaked.

The exploit was discovered with the help of AI, researchers at Wiz wrote – “The vulnerable code had been there for more than a decade – what AI changed was the ability to understand the weaknesses and turn them into a working exploit.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.”

The PHP issue forced many high-profile sites to be taken temporarily offline to ensure circumvention of the exploit – PHP is now urging organisations to use the issued updates across their PHP code to secure them against the vulnerabilities.

While PHP is an underlying part of much of the internet’s digital infrastructure, is this vulnerability cause of alarm?

“We need to find the signal in the noise here. AI discovering vulnerabilities isn’t new. This scale of vulnerability isn’t unheard of either – Heartbleed, Apache Struts, and Log4j were similarly impactful, although perhaps not as wide-ranging,” Richard Meeus, senior director of security technology and strategy EMEA at Akamai Technologies said.

“What’s new here is how AI is working as an accelerant – both in vulnerability discovery, and vulnerability exploitation. It’s vitally important that businesses which believe they may be impacted patch their sites as soon as possible or virtually patch using their Web Application Firewalls, and consider going offline until this can be achieved.”

Still, while this may not be cause for total catastrophe, cyber firms are being put to work:

“Cybersecurity has always been a race against time, but because PHP is pervasive across business technology and its supply chain, organisations face the huge task of identifying every potential point of exposure,” Valentino De Sousa, Accenture’s Cyber Threat Intelligence Lead, EMEA, said.

“The immediate challenge for organisations isn’t just patching the vulnerability – it’s establishing where PHP is running in the first place. It can be embedded in applications and third-party products where organisations might not immediately expect it, so many are assessing their exposure while trying to fix it.”

“AI is fundamentally changing the pace at which long-standing vulnerabilities can be uncovered and investigated. In this case, security researchers predicted the flaw first, but it took AI-based approaches to identify exactly how to trigger it, demonstrating how the window to understand exposure and respond is tightening. That means organisations need to know what is running across their technology estate and have a robust ‘lifeboat’ plan to keep critical operations running while vulnerabilities are addressed. Both are becoming just as important as the speed of patching.”

Recommended reading

• CrowdStrike Reveals Global Outage Details
• IT Supply Chain Overhaul in Wake of CrowdStrike Outage
• CrowdStrike Incident | Lessons Learned and Key Questions Answered
• FCA Declares Operational Resilience Deadline For CrowdStrike Outage

The stock market is also reacting to the renewed global attention to cyber – firms like Cloudflare, CrowdStrike, Okta, Rapid7, and JFrog have seen their stocks jump as governments and companies rally to secure their websites and infrastructure.

Chris Dimitriadis, Chief Global Strategy Officer at ISACA, reflected on what this all means for UK organisations and their supply chains: “A single vulnerability can trigger a global domino effect across borders and industries within hours. What we’re seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI.

“But the real concern isn’t just the vulnerability itself. It’s what it reveals about our preparedness. Cyber resilience isn’t something organisations can switch on when a crisis hits. They need to understand where they are exposed, recognise their technology dependencies and have the right people, processes and controls in place to respond quickly and effectively.

“Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a security flaw from becoming a much bigger crisis. Most of all, that means investing in the next generation of cybersecurity professionals, who can use AI to find and fix weaknesses faster than attackers can exploit them.”