CERT‑In issued a critical‑severity warning on Wednesday over two PHP vulnerabilities that could let unauthenticated attackers run malicious code on any system. The flaws affect PHP 7.2–7.4, widely used in web applications, and the advisory noted that attackers had already exploited the bugs in the wild, generating millions of hacking attempts worldwide.
Microsoft CEO Satya Nadella, speaking in Cologne, called the scale of the incident "unusual" and "unseen in a long time," underscoring the global reach of the threat. The announcement came after Google Cloud, Cloudflare, and other cloud providers reported thousands of attempts in the hours before public disclosure.
Google Cloud confirmed its own infrastructure was not vulnerable but warned customers running PHP applications on its platform could be exposed. The company is rolling out updated serverless base images for supported PHP runtimes and urging users to redeploy patched versions.
Cloudflare logged over 10,000 exploit attempts before the public advisory and successfully deployed mitigations for all customers. Both providers call for immediate updates; failure to patch could leave systems exposed until the next major vulnerability patch cycle.
The incident has prompted a wave of precautionary shutdowns of online services, with a Bangalore‑based online retailer temporarily disabling its checkout to protect customer data.