Advertisement
Millions of Cyberattack Attempts Target Websites as Critical PHP Flaws Threaten Crypto Platforms
- Cloudflare chief executive Matthew Prince said exploit attempts climbed from thousands before disclosure to millions after it.
- The PHP Foundation said a 2024 audit first surfaced one of the flaws and that work on a fix stalled for months.
- SlowMist told crypto firms to upgrade, and Australia’s cyber agency issued a critical alert on the flaws.
Hackers made millions of attempts to exploit two critical flaws in PHP, the programming language behind much of the web, after its developers released fixes on Wednesday, according to Cloudflare.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” Cloudflare chief executive Matthew Prince wrote on X late on Wednesday.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity score of 9.2 out of 10. Both affect all web servers running PHP 5.4 or later, according to Cloudflare. Crafted web requests may let an attacker crash a server, expose sensitive data or run their own code.
Cloudflare said PHP is used by almost 70% of websites, including those built on WordPress and Magento.
A Fix That Stalled Since 2024
The PHP Foundation said a contracted core developer found the first signs of the memory problem behind one of the flaws in 2024. That came during PHP’s first external security audit in years, carried out by Quarkslab.
The security team drew up several competing fixes, but each one carried trade-offs. Its work then stalled and restarted for months, the foundation said in a blog post on Wednesday.
We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.
PHP Foundation
Security firm Calif reported a remote code execution flaw with the same root cause on 11 August. After the vulnerability IDs leaked online, PHP brought its release forward a day to 21 October.
The foundation said AI-assisted research now finds bugs faster than ever, for defenders and attackers alike. Crypto security experts say AI tooling is speeding up both smart contract hacks and bug hunts.
Read more: Switzerland Approves First Retail Bitcoin ETF Under Domestic Fund Rules
Crypto Platforms Told to Patch
Blockchain security firm SlowMist said its MistEye system had scanned PHP-related assets across the crypto industry. It urged platforms, DeFi projects and wallet providers to assess their risk and install the patched versions.
Advertisement
BNB Chain executive director of growth Nina Rong posted that the network does not use PHP in its technology stack, and Binance founder Changpeng Zhao posted a warning on X for anyone browsing.
In April, attackers hijacked CoW Swap’s front-end domain and drained at least US$1 million (AU$1.43 million) from users.
The Australian Signals Directorate’s cyber centre rated its PHP alert critical. It said it was not aware of successful active exploitation within Australia. The agency’s own website, cyber.gov.au, was among the government sites that reported outages.
Read also: BlackRock Makes a Splash with New Bitcoin ETF Filing as IBIT Takes in US$665M
Author
José Oramas
José is a journalist and translator with a keen interest in blockchain and cryptocurrencies.
