There you have it! Cloudflare's CEO, Matthew Prince, says PHP2Shell exploit attempts went from th…
October 22, 2026 · 0 likes · 0 comments
AI Cybersecurity
There you have it! Cloudflare's CEO, Matthew Prince, says PHP2Shell exploit attempts went from thousands to millions in a matter of hours.
His numbers, posted on X: thousands of attempts in the 10 hours before the flaws were announced. Then "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Those are attempts, not confirmed break-ins. Nobody has published a count of compromised sites yet.
The outages are real, though. The Finnish government's website was only partly available Wednesday. Other European government sites went dark. Certain Wikipedia services and 4chan were pulled until they could be patched.
The FBI's cyber division told operators to take sites offline if they couldn't update immediately. Officials from the U.S. to Japan said the same.
And OpenAI, which led the coalition that found the bugs with AI models, says it expects similar findings to "increase sharply in the coming months."
So patching this one is just the start of the line.
Here's what I did about my own legacy PHP problem.
I had an old WordPress site. Plugins, a page-builder theme, the usual pile. Getting it redone properly would have cost about $40k before AI.
My agents rebuilt it from scratch in about an hour and moved it to Node. Total cost: around 20 bucks of tokens.
No WordPress, no PHP runtime, no plugin graveyard to babysit every time a new CVE drops.
Now, my view, and only my view: a lot of companies keep legacy WordPress sites alive because a rebuild "costs too much." That math just broke. When agents can redo a site for the price of lunch, keeping a forgotten PHP box exposed to the internet is a choice.
Node isn't magic. It has its own vulnerabilities, and we patch it too. PHP is where I started, and I respect what it built. But software you don't patch and don't own is a liability whatever language it's written in.
The difference is you get to choose a stack you actually maintain, instead of one you inherited.
Patch your PHP today. Then ask what it would cost to stop needing it.
Full story. Facts, not spin: https://lnkd.in/eS2Qatmb
His numbers, posted on X: thousands of attempts in the 10 hours before the flaws were announced. Then "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Those are attempts, not confirmed break-ins. Nobody has published a count of compromised sites yet.
The outages are real, though. The Finnish government's website was only partly available Wednesday. Other European government sites went dark. Certain Wikipedia services and 4chan were pulled until they could be patched.
The FBI's cyber division told operators to take sites offline if they couldn't update immediately. Officials from the U.S. to Japan said the same.
And OpenAI, which led the coalition that found the bugs with AI models, says it expects similar findings to "increase sharply in the coming months."
So patching this one is just the start of the line.
Here's what I did about my own legacy PHP problem.
I had an old WordPress site. Plugins, a page-builder theme, the usual pile. Getting it redone properly would have cost about $40k before AI.
My agents rebuilt it from scratch in about an hour and moved it to Node. Total cost: around 20 bucks of tokens.
No WordPress, no PHP runtime, no plugin graveyard to babysit every time a new CVE drops.
Now, my view, and only my view: a lot of companies keep legacy WordPress sites alive because a rebuild "costs too much." That math just broke. When agents can redo a site for the price of lunch, keeping a forgotten PHP box exposed to the internet is a choice.
Node isn't magic. It has its own vulnerabilities, and we patch it too. PHP is where I started, and I respect what it built. But software you don't patch and don't own is a liability whatever language it's written in.
The difference is you get to choose a stack you actually maintain, instead of one you inherited.
Patch your PHP today. Then ask what it would cost to stop needing it.
Full story. Facts, not spin: https://lnkd.in/eS2Qatmb