PHP Fixes Released as Cloudflare Reports Millions of Attempts

The PHP project released fixes for two critical software flaws on October 21 as organizations rushed to secure systems and Cloudflare reported a sharp rise in attempts to exploit them. The reported activity does not establish that any affected customer was breached. Cloudflare Chief Executive Matthew Prince said the company’s network recorded thousands of attempted exploits in the 10 hours before public disclosure. He said the count rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions thereafter. Those figures came from Prince’s account of activity across Cloudflare’s network. The flaws, identified as CVE-2026-10961 and CVE-2026-10962, each received a critical severity rating of 9.2 under the Common Vulnerability Scoring System. The corrected releases listed by the PHP project are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The vulnerabilities affect PHP itself, the server-side software used to process website requests, so updating a website plugin alone would not address them. Cloudflare said it activated default web application firewall protections for affected customers at 11:02 p.m. Eastern time on October 20, before the PHP fixes...