Cloudflare provided free protection against PHP vulnerabilities as Prince discussed disclosure trade-offs

Cloudflare CEO Matthew Prince said OpenAI and security researchers found a remote code execution (RCE) vulnerability in PHP and notified Cloudflare and other organizations about two months before public disclosure. PHP is used by about 70% of the web, and popular content management systems such as WordPress are built on it. The vulnerability let an attacker send requests to a server, take it over and run code on it—for example, read files and capture usernames and passwords. A compromised server could also be used for other criminal activity. Later, Wiz, a Google subsidiary, reported a second PHP vulnerability.

Prince said the Google and OpenAI teams worked with industry leaders, including Cloudflare, to address the issue. The effort also involved Automattic, the creator of WordPress; the PHP Foundation, which maintains PHP; and the U.S. government. Over two months, organizations coordinated their response to the risk. Cloudflare quietly enabled free protection for all its customers, including free-tier users. Prince described it as a temporary measure that bought time, not a substitute for installing the fix.

Prince said they saw an uptick and signs that information had leaked about 36 hours before the patch was released. After publication of the patch, attackers had enough detail to work out how to exploit the vulnerability: in the hours before its release, Cloudflare saw thousands of attacks across its network; afterward, it was seeing millions of attempted attacks per minute. Cloudflare’s protection helped, but Prince urged server operators to install the latest PHP version. The update is free and, he said, takes only a few minutes. Managed platforms such as WordPress often install updates automatically. He also relayed NSA guidance: if a patch cannot be installed, taking the server offline is safer than leaving it unprotected.

Prince called it difficult to decide who should receive advance access to information about new vulnerabilities, and when. The more people and organizations receive it, the greater the risk that it will reach someone who could cause real harm. At the same time, European banks and leaders ask why they do not get access to new technologies and say they feel vulnerable. Prince said that when Cloudflare was a small startup, it too asked why it was not told about new vulnerabilities; now Cloudflare receives such information, while startups ask how they can get access. He said there is no perfect answer. In his assessment, disclosure almost two months in advance gave organizations time to prepare and patch the issue, helping mitigate what could have been a disaster. He praised the OpenAI, Google and Wiz teams for their handling of the process, while acknowledging it was not perfect and calling it very good.