Cloudflare has reported millions of attempts to exploit newly disclosed flaws in PHP, the widely used web software, according to a Nextgov/FCW report. Researchers also warned that compromised websites could put their visitors at risk, not just the people who run them. If you are wondering about the PHP vulnerability what visitors should do, the short answer is that you cannot patch someone else's server, but you can limit what an attacker gets if a site you use is compromised.
The details available so far are limited, so this article sticks to what has been reported and to general protective practices.
What Cloudflare Is Seeing in the PHP Exploit Attempts
According to the report, Cloudflare observed millions of attempts to exploit the PHP flaws. The coverage also describes a global push to get fixes in place. That combination is common after a widely used piece of software is hit by a public disclosure: attackers scan the internet for servers that have not yet been updated, and administrators race to apply patches.
PHP is a server-side language, which means it runs on the web server rather than on your device. That matters because it shapes who needs to act. Site owners and hosting providers have to apply updates. Visitors have no way to do that for them.
Our earlier explainer on the PHP flaw disclosed Oct 22 covers how the language underpins a large share of the web and why most people had never heard of it before the news broke.
How a Compromised PHP Site Can Put Visitors at Risk
Researchers cited in the report warned that compromised sites could also endanger the people who visit them. While the specific attack paths for these flaws are not detailed in the summary we have, there are general ways a hijacked website can affect users:
- Login theft: If an attacker controls a site, they may be able to capture usernames and passwords typed into its login page.
- Form data exposure: Contact forms, checkout pages, and sign-up forms can be altered to send what you type to someone else.
- Malicious redirects or downloads: A compromised site can be modified to push visitors toward harmful pages or files, which can put your device at risk.
None of this means every PHP site is dangerous. Most sites will be patched, and many were never vulnerable. The point is that the weak link may be a server you have never thought about, so it helps to plan for that possibility.
What a VPN Can and Can't Do Against Server-Side Flaws
A VPN encrypts the connection between your device and the VPN server and hides your IP address from the sites you visit. That is useful on public Wi-Fi and for limiting some tracking.
It does not fix a flaw on the website's server. If a site you visit has been compromised, your traffic still arrives at that site, and anything you submit there can still be seen by whoever controls it. A VPN also does not stop you from entering your password into a tampered login form. Think of it as one layer of privacy protection, not a defense against a server-side bug.
What This Means For You
You probably cannot tell which sites run vulnerable PHP versions, and you do not need to. What matters is reducing the damage if a site you use is breached. The main risks are reused passwords, accounts without a second verification step, and delayed awareness that your information was exposed. Each of those is something you can control today.
Practical Steps to Protect Yourself While Sites Patch
- Use a unique password for every account. A password manager makes this realistic. If one site leaks your password, the damage stops there.
- Turn on two-factor authentication (2FA). Even if a password is captured, a second factor makes it harder to use. Authenticator apps or hardware keys are generally stronger than text messages.
- Be cautious with sensitive forms. Avoid entering payment or personal details on sites that look unusual, load oddly, or behave differently than before.
- Keep your browser and operating system updated. This reduces the chance that a malicious page can exploit a known weakness on your device.
- Watch for breach notices. If a company tells you it was affected, change your password promptly and review account activity.
- Use a VPN for what it does well. It helps on untrusted networks, but do not rely on it to offset a compromised website.
The Bottom Line
The reported surge in attempts shows how quickly attackers move once flaws become public, and how much of the web depends on software its visitors never see. The best answer to the PHP vulnerability what visitors should do question is to make stolen credentials less useful: unique passwords, 2FA, and attention to breach alerts. For a concise checklist, read our guide on five ways to stay safe online after the PHP flaw and put those steps in place while site owners work through their patches.
