Cloudflare CEO Matthew Prince: AI found a critical PHP vulnerability hitting 70% of the web — and millions of attacks are happening per minute

PHP2Shell: AI finds a critical vulnerability hitting 70% of the web

A critical remote code execution flaw in PHP, the programming language underpinning roughly 70% of the web, is now being actively exploited at a scale Cloudflare describes as millions of attacks per minute.

OpenAI first disclosed the vulnerability to Cloudflare approximately two months ago, after its models — working alongside independent security researchers — identified the flaw. Wiz, the Google-owned security firm, subsequently found a second PHP vulnerability and disclosed it through the same channel. Both organizations then quietly coordinated with Automattic (WordPress's creator), the PHP Foundation, and the U.S. government to patch the flaw before going public. That the disclosure stayed contained for two months, across that many institutions and countries, was, by Prince's telling, something close to a minor miracle.

The vulnerability qualifies as an RCE, or remote code execution flaw, meaning an attacker can send basic requests to a server and take it over entirely — reading files, intercepting usernames and passwords, conscripting the server into a botnet, or using it to distribute illegal content. The NSA has since issued guidance that if a patch cannot be applied immediately, taking the server offline is preferable to leaving it exposed.

Cloudflare quietly deployed protections for all customers, including free-tier users, in the weeks before the public disclosure. Prince frames it as a bandage: it buys time, but anyone running a PHP server needs to apply the patch directly. For managed platforms like WordPress, that update typically happens automatically.

“We went from seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute across our network where people are trying to compromise servers... The NSA has issued guidance that if for some reason you can't issue the patch, it's actually better to take your server offline than it is to run it naked right now.”

How the exploit spread

Details leaked in the roughly 36 hours before the PHP Foundation released the official patch. Once the patch was public, it gave attackers enough information to reverse-engineer the exploit. Attack volume jumped from thousands to millions per minute almost immediately.

The attackers driving most of that volume are not using AI. They are running straightforward scripts that probe every IP address on the internet for vulnerable servers. Where AI has changed attacker behavior is in what happens after a breach. Prince points to a Russian hack of a Salesforce plugin roughly a year ago: the attacker had broad access but, unfamiliar with how Salesforce worked, fumbled the opportunity and caused far less damage than the access warranted. The same intrusion today, he argues, would be far more destructive because AI now lets attackers rapidly orient themselves inside an unfamiliar environment and identify what to take.

The more sophisticated agent-swarm style of attack — the kind Prince associates with the OpenAI Hugging Face compromise he references — still costs hundreds of thousands to millions of dollars to run. For now, that keeps it largely out of reach for typical criminal operations, though Prince treats nation-state actors — China, Iran, the NSA — as a separate category where the calculus is different.

The broader threat pipeline

Beyond PHP, this week also produced a Node.js vulnerability with consumer implications, and a separate disclosure that an Indian company operating root key servers — the certificates that underwrite internet encryption — had secured them with passwords as short as the number 4, with the most complex password used being 136. Browsers and operating systems have since distrusted those certificates, but users who haven't updated remain exposed to spoofing attacks. Prince's advice is simple: accept OS and browser update prompts.

Prince is direct that this week is not an anomaly. Cloudflare already has visibility into multiple substantial vulnerabilities that will surface over the coming weeks and months. His expectation is roughly two years of weeks like this one, driven by AI tools that can probe for vulnerabilities with unlimited patience.

His framing is that AI didn't create these vulnerabilities — they were already there. Finding them is better than leaving them dormant. There are, however, people at agencies like the NSA who are unhappy: some of these flaws were being used for intelligence gathering, and the public disclosure closes that window.

The ten-year prediction

On the structural question of where the internet is heading, Prince argues the business model breaks down before the decade is out. Automated and agent-driven traffic is on track to exceed human traffic by 1,000 times within five years. For context, internet traffic doubling during COVID nearly caused the infrastructure to collapse.

His working solution is micropayments — fractions of a cent paid each time an agent accesses a resource — with a price discount or even a reversal (sites paying agents to visit) if the agent discloses what it is looking for. That disclosure creates an advertising primitive: a travel site that knows an agent is searching for a five-star Maui resort with availability can bid to be matched. Prince thinks the industry will need to resolve this before the end of the decade, and it is where Cloudflare is spending significant internal focus.