On Wednesday, several European government websites went offline. The Japanese government has recommended suspending some of its content, and many companies have decided to disconnect their pages due to the possibility of cyberattacks. No one wanted to fall first.
The reason server administrators around the world were holding their breath was a bug that had been hidden for more than a decade in the PHP code, the language that powers about 70% of all Internet pages. When some pressed the panic button on their servers, CloudFlare took on an unexpected role: It became the shield that protected millions of users and small business websites that didn’t have a team of cybersecurity experts on the payroll.
The gap spanned decades. lThe two flaws were registered as CVE-2026-109618 and CVE-2026-109619, although they were already known globally as PHP2Shell. As INCIBE warns, this vulnerability allows an attacker to execute malicious code directly on the server without credentials. It is considered a threat with a score of 9.2 out of 10, which is why many administrators prefer to pull the plug on their servers rather than open themselves up to cyber attacks.
The PHP Foundation acknowledged that the problem was detected after an external audit in 2024, but the fix was stuck for months and took a “mea culpa”, admitting that “the delay was a structural failure”. In August, Calif and OpenAI showed that you could run code without a certificate, and everything was denied, but the patch couldn’t be deployed in time.
Four days before the patch. The announcement of the vulnerability’s existence and its patch came on Wednesday, October 21, causing panic among administrators. But Amazon already detected an attempted attack on that vulnerability on October 17 against one of its decoys (trap servers to study attackers). It comes from a commercial anonymous network. Amazon doesn’t know how the attacker got that information.
According to the PHP Foundation, information about the vulnerability was then leaked. On Tuesday, October 20, two identifiers were already circulated on forums and networks One of the companies that reported the bug released a video with proof of the misconception And another agency released photos with the arrangement more than six hours before it was agreed.
Cloudflare Shield. With news of the existence of a security breach that would allow Pedro to access millions of web services like wildfire through special forums, there was no choice but to take drastic measures to build security shields. CloudFlare has been developing its rules with the PHP Foundation, OpenAI and Wiz since early October, the company details. Facing a pre-attack avalanche, Cloudflare enabled protection by default on October 21. About eleven hours before the patch that fixed the issue was announced.
The barriers that CloudFlare put in place were not limited to its corporate customers, but also secured web firewalls and customers on the free plan. According to data from W3Techs, this CloudFlare Shield may be the only protection for one in four websites on the entire Internet.
Simple security rules weren’t enough to deal with the vulnerability, so the company developed “full transaction detection,” which analyzes user requests and server responses. If nothing is added, block the response before it reaches the person who requested it. That is, your network is placed between visitors and servers, which is how CloudFlare works and allows traffic to be filtered.
Attack at a machine speed. Expectations of CloudFlare deploying shields that protected millions of pages were not justified. According to Reuters, in the ten hours before the announcement, CloudFlare detected thousands of attempts to exploit the vulnerability. Its CEO, Matthew Prince, claims that “it grew to hundreds of thousands within 45 minutes of the announcement. Then, hundreds of thousands in two hours and now millions.”
Amazon’s head of security CJ Moses believes that AI explains a good part of the increase in the number of attack attempts, and that the time between patches and effective exploits is “being reduced for structural reasons.” AI-assisted analytics makes it cheaper, he added.
In Xataka | Microsoft considers that “frontier models are not credible” and that AI agents must be considered an insider threat
Picture | Unsplash (Glen Carey)
