EXPLORINEER
en

DE — heise online

Cloudflare CEO Expects Many More Flaws Like php2shell

Security1 min read

Cloudflare's CEO says more serious software security holes are coming, after the recent php2shell and Broccoli2Shell flaws. He thinks AI tools are helping more people search for these holes.

What happened

Matthew Prince, the CEO of Cloudflare, told the news agency Reuters that the recent flaws php2shell and Broccoli2Shell are only the start. He said that for a few years, it may feel every week like the sky is falling. Cloudflare was one of the first companies to spot and block attacks that used php2shell. Prince also said Cloudflare knows of several other serious flaws in other important software parts. He did not name the affected projects.

Key facts

  • php2shell let attackers take over other people's systems from far away.
  • Work on the fixes for php2shell took months.
  • Patrick Garrity of VulnCheck expects 'a lot more fire-fighting' for anything exposed to the internet.
  • Experts agree that the time between finding a flaw and an attack is getting shorter.

Why more flaws are being found

A security flaw is a mistake in software that bad actors can use to break in. More and more people now use AI to search for these mistakes. Many websites still run old versions of PHP, a popular programming language for websites, and some of these installations are decades old.

Why it matters

If more flaws appear quickly, website owners have less time to fix their systems before attackers strike. Tobias Glemser of the German company secuvera says that regular updates for all software are needed to escape this problem.

What to watch

  • Whether more serious flaws in other key software are published in the coming weeks.
  • How quickly companies release patches after a flaw is found.
  • Whether old PHP installations get updated or removed.

Glossary

Cloudflare
A company that protects websites from attacks and speeds them up, using a network of servers and a web firewall.
PHP
A popular programming language used to build many websites.

More in this topic

SecurityThe Register

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.

SecurityITmedia

Customers to Sue Times Car Operator Over Data Leak, Lawyer Announces at Press Conference

Attorney Yuki Makino, who set up a class-action website, announced at a Tokyo press conference on October 26, 2026 that he will file a lawsuit at the Tokyo District Court against Park24, which operates Times Car, and its executives, seeking 30,000 to 50,000 yen per victim in damages. The suit follows a leak of up to about 6.6 million members' personal information, including driver's license images, after unauthorized access detected on September 25; more than 100,000 people have registered on the site.

SecurityITmedia

Joshin Unauthorized Access May Have Leaked Up to 6.23 Million Records, Including 2 Driver's Licenses and 1 My Number Card

Joshin, the Japanese electronics retailer that also runs a housing renovation business, said on October 26 that up to about 6.23 million member records may have leaked after unauthorized access to its network, which it had announced on the 17th. The data may include names, addresses, driver's license images, My Number Card information, and login details, and the company said the scope and whether any leak actually occurred are still under investigation. Joshin said it has no credit card information stored and warned users to be alert to suspicious emails, SMS messages, and calls impersonating the company.

Security전자신문

Cyber Intrusions Spread to Insurers, Software and Travel Sectors as Financial Sector Breaches Mount

Mirae Asset Life Insurance reported a suspected personal data leak after detecting abnormal activity and notifying the Financial Supervisory Service, marking the insurance sector's first reported intrusion. Separate breaches hit enterprise software firm Douzone Bizon, which is investigating a possible leak of external partner and client employee data tied to a suspected zero-day flaw in backup software, and travel platform NOL, which confirmed leaked data from domestic accommodation booking customers. KB Kookmin Bank said the number of affected people in its earlier breach rose to 2,210 after 2,091 more were identified.