Cloudflare Sees Attack Traffic Targeting Critical PHP Flaws
Photo: TokenPost
Cloudflare observed attack traffic targeting two critical PHP flaws as details circulated ahead of the fixes. The company enabled default protections for customers using its web application firewall at 11:02 p.m. ET on Oct. 20 (03:02 UTC on Oct. 21). Installing a fixed PHP version remains the complete remedy. PHP released fixes on Oct. 21 for CVE-2026-109618 and CVE-2026-109619. Each flaw has a critical severity score of 9.2 under version 4.0 of the Common Vulnerability Scoring System. The vulnerabilities can let someone run code on an affected web server without logging in.
Source: TokenPost
