The issues are collectively called php2shell. The foundation issued emergency patches and urged affected operators to update immediately or take sites offline until they can do so.
Fortune reports that the flaws can permit remote code execution on unpatched PHP systems. It says Cloudflare observed tens of thousands of exploitation attempts within 45 minutes after reports surfaced on October 20, hundreds of thousands within two hours, and millions by the evening of October 21. AWS said it had observed broad exploitation in the wild, including attempts in the days before public disclosure.
The article cites a Palo Alto Networks estimate of 22.6 million potentially vulnerable instances and characterizes PHP as serving up to 70% of the web. It also reports precautionary site shutdowns by some agencies in the Netherlands and Finland, plus update advisories from the FBI, NSA, and EU CERT.
The supplied report does not establish the exact number of exposed systems, patch adoption levels, or the technical details and conditions required to exploit each affected deployment. It attributes discovery to AI tools but does not provide enough evidence to assess the tools' specific role or reproduce the finding.