Hackers Launch Millions of Attacks Exploiting PHP Flaws
The Facts
- Cloudflare CEO Matthew Prince said Thursday that the company had recorded "millions" of attempts to exploit the critical PHP flaw, rising from thousands in the 10 hours before public disclosure to hundreds of thousands within two hours of the announcement.
- Baroness Lloyd of Effra told the House of Lords that 32 U.K. government services were unavailable and four were partially unavailable because of the PHP issue. A No. 10 spokeswoman said no large, public-facing critical services were affected.
- Amazon Web Services also detected an exploit attempt on Oct. 17 against a decoy server built to attract hackers, days before the flaws were disclosed, and described the exploit known as PHP2Shell as "now being broadly exploited in the wild."
Sources Split
LEFT
CENTER
RIGHT
+2
+1
+2
+1
+1
+1
ESTAB
CRIT
CENTER
PRO
ESTAB
The Spin
Narrative A
Defense is losing this race. Exploits that once demanded elite skill and months of work now assemble in hours, while patching still crawls along, one server at a time. The only sane posture left is building systems that assume the attacker already has a foothold, because waiting for the next emergency fix is a losing bet.
Narrative B
The same tools getting blamed for this mess are what dragged a decade-old weakness into the light before it could be quietly abused for years more. Pulling services offline and shipping fixes fast is a sign of effective defense, rather than proof of collapse. The real failure is the set-it-and-forget-it habit of running sites nobody bothers to update.
Metaculus Prediction
Public Figures
The Controversies
© 2026 Improve the News Foundation.
All rights reserved.
Version 7.18.3