• Cloudflare (NET) has pushed live emergency firewall protections for two critical PHP vulnerabilities rated 9.2 under CVSS v4.0, covering all customers including free-tier plans.
  • CTO Dane Knecht calls the defenses a stopgap, warning operators to install PHP's own security update rather than treat WAF coverage as a permanent fix.
  • Government agencies across Europe and Asia have shuttered websites as a precaution, and initial exploitation attempts are already surfacing.

A Stopgap, Not a Cure

Cloudflare has activated emergency web application firewall rules across its global network to blunt attacks exploiting two critical PHP vulnerabilities, each scored 9.2 under the CVSS v4.0 severity standard. Dane Knecht, the company's chief technology officer, said the initial protections are live for all customers—including those on free plans—but was blunt about their limits.

The rules, he said, are "a stopgap," and website operators should install PHP's own security update as soon as it becomes available. Cloudflare is adjusting the defenses in real time as new attack vectors emerge, according to Knecht, who noted that early exploitation attempts are already being observed.

As of 9:46 a.m. EDT on October 21, the announced PHP release time of 14:00 UTC—10:00 a.m. EDT—had not yet arrived. The sources reviewed do not establish that PHP's final patches had shipped, and PHP's security team has said affected versions, fixed versions and full technical details will accompany that release. Claims about the precise scope of the flaw should remain provisional until the advisory appears.

Shutdowns Spread Across Borders

The response has already widened well beyond one cloud vendor. Precautionary shutdowns of government websites have been reported in the Netherlands and Finland, alongside warnings from cybersecurity agencies in Europe, Australia, Japan and Britain. CERT-EU has advised organizations to consider isolating exposed systems where immediate patching is not feasible. Singapore's Cyber Security Agency has urged operators to prioritize internet-facing installations.

A precautionary shutdown does not itself establish that a site was compromised. Still, the fact that even the Dutch cybersecurity agency took its own website offline underscores how a flaw buried in a widely used programming language can escalate into a public-service continuity problem.

The stakes are broad because PHP underpins WordPress, Drupal, Joomla and Magento, as well as shared-hosting infrastructure and countless custom applications. Small businesses, charities and independent publishers may be entirely dependent on their hosting providers to perform what is, at bottom, a server-level fix. Wordfence has warned that a routine automatic WordPress update will not apply this remediation, while GoDaddy (GDDY) has issued its own preparation guidance for site owners.

Financial and Operational Fallout

For Cloudflare, the episode cuts both ways. The company, listed on the NYSE under NET, reported revenue of $696.1 million for the quarter ended June 30, up 36% year over year, with adjusted operating income of $96.1 million and free cash flow of $56.4 million. It remains loss-making on a GAAP basis, posting a net loss of $170.0 million, a figure that included $150.7 million in restructuring and other charges tied to an "agentic AI-first" operating model. Cash and marketable securities stood at $4.16 billion.

No reliable estimate of incident-specific losses—or of any demonstrable financial benefit to Cloudflare from the emergency—appears in the reviewed sources. The company attributes its broader growth to demand for AI-related infrastructure and developer tools, not to this unfolding event. Knecht assumed the CTO role in March 2025, succeeding John Graham-Cumming, who moved to the board; Matthew Prince remains co-founder and CEO.

The immediate economic risk falls on businesses and public services running PHP-based systems. Operators face an uncomfortable trade-off between service availability and security: keeping an exposed site online may invite compromise, while taking it down interrupts access and potentially transactions. Security specialists also warn that end-of-life PHP installations may require migration to a supported branch rather than a simple update—an expensive proposition for organizations already stretched thin.

Cloudflare declined to comment beyond Knecht's public remarks, and PHP's security team did not respond to a request for comment ahead of its scheduled release. Marcus Webb of Phoenix Security cautioned that a core remote-code-execution vulnerability of this kind can expose content-management, e-commerce and custom applications simultaneously, while Qualys (QLYS) has flagged unsupported PHP installations as a priority for upgrade planning. Those are expert assessments, not a verified count of compromised sites.

Update: This article will be revised once PHP publishes its official advisory confirming affected and fixed versions.