Millions of Cyberattacks Hit Websites Worldwide Within Hours

Jakarta, CNBC Indonesia – The attacks targeted a security flaw known as PHP2Shell. Cloudflare’s records show that exploitation attempts reached millions.

“During the 10 hours before it was announced publicly, we saw thousands of attempts to exploit it across the Cloudflare network. That rose to tens of thousands in the 45 minutes after the announcement, hundreds of thousands in two hours, and millions by now,” Cloudflare chief executive Matthew Prince said in a post on his official account.

The UK’s National Cyber Security Centre (NCSC) said two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow attackers to run their own commands on PHP-based servers without logging in. It described them as among the most serious types of security flaw.

The agency added that attackers could cause PHP memory to become overloaded, potentially using the resulting disruption to take control of a server.

Wikipedia was among the sites affected. The Wikimedia Foundation, which operates the site, confirmed disruption caused by the PHP vulnerabilities.

Wikimedia is also working to address the flaws in PHP, which is used by most wikis. “This issue affects all known versions of PHP; it is not specific to the Wikimedia Foundation,” the organisation said in a statement, as quoted by Mashable on Friday (22 October 2026).

The PHP Foundation, which supports the programming language, released emergency security updates last Wednesday to fix the two critical vulnerabilities.

The NCSC, Japan’s Prime Minister and the US National Security Agency have urged organisations to install the newly released patches as soon as possible.

PHP is a programming language that runs on web servers. It operates behind the scenes, retrieving data from databases and building pages before they reach a user’s browser when a web page is loaded.