Cloudflare CEO Matthew Prince: the PHP remote-code-execution attack wave, now millions of attacks per minute

Key points

Cloudflare chief executive Matthew Prince detailed the ongoing wave of PHP remote-code-execution attacks in an interview with TBPN published on 23 October 2026. About two months before the interview, OpenAI had reached out to Cloudflare after its models, combined with work by security researchers, found a remote-code-execution vulnerability in PHP — a language used by roughly 70% of the web, including WordPress. An RCE flaw lets an attacker take over a server by sending it ordinary requests: reading its files, harvesting usernames and passwords, and enlisting it in botnets. A second PHP vulnerability was subsequently disclosed by Wiz.

OpenAI's and Google's teams quietly coordinated with Cloudflare and Automattic, the creator of WordPress, before the PHP Foundation released a patch. Cloudflare rolled out free protection for all of its customers behind the scenes as a stopgap. Attacks rose from thousands to millions per minute once the patch went public — because the fix reveals enough detail for attackers to reconstruct the exploit — and the uptick began in the 36 hours before the interview. Prince advises every server operator to update to the latest PHP version now, and notes the NSA has said that if a server cannot be patched, it is better to take it offline than to run it unpatched.

Read more: TBPN on YouTube