Cloudflare’s Matthew Prince said the network saw thousands of exploit attempts even before the PHP vulnerability was publicly disclosed.

Cloudflare’s CEO Matthew Prince warned that the network saw millions of exploit attempts after a critical security vulnerability was publicly revealed.

In the 10 hours before the PHP vulnerability’s disclosure, the network saw thousands of exploit attempts, which have now reached “millions,” Prince said in a Thursday X post.

Cloudflare is an internet infrastructure company that helps websites load faster and protects them from cyberattacks. About one in five websites worldwide routes traffic through its network, according to the company.

On Wednesday, the PHP Foundation acknowledged that a shortage of resources delayed a fix for a critical security flaw first identified in 2024 and released emergency patches for two critical vulnerabilities.

The vulnerability may allow attackers to spread malware or inject malicious scripts into websites around the world. PHP powers an estimated 69% of websites with a known server-side programming language, according to research service W3Techs.

The two critical vulnerabilities may “allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks,” warned the FBI’s Cyber Division in a Wednesday X post, urging organizations to either adopt an immediate update or take their systems offline.

Multiple organizations and government agencies took websites offline Wednesday as a precautionary measure.

Related: Drift exploiter sends $109M in Ether to Tornado Cash in 2 days