Cloudflare CEO Warns Hackers Likely Exploited PHP Flaw for Years, and AI Agents Are Straining Websites

Cloudflare CEO Matthew Prince says nation-state actors and criminals likely exploited the PHP2SHELL vulnerability well before it was publicly disclosed. Speaking on the company's third quarter earnings call, he said vulnerabilities like the recently disclosed PHP flaws had been in the wild for years. Cloudflare is now searching its logs for evidence of past exploitation, and Prince said he is confident it will find examples.

Prince also raised a business concern: some Cloudflare customers see AI agents as "a bane to their business" and want to keep them away. He gave an example of an agent visiting 1,000 restaurant websites and downloading 1,000 menus so a person can pick just one. In that case, 999 restaurants bear a cost without any benefit. He accepted that search traffic has always included some low-value visits, but said the expected volume of agent activity changes the scale of the problem. Cloudflare has previously predicted that agent traffic will be one thousand times greater than clicks from humans.

Prince further argued that container-based architecture cannot keep up cost-effectively with this agent-driven demand. The register notes this is a Cloudflare-centric view, as the company sells a serverless service called Workers as an alternative. Cloudflare also offers products to block agents, reduce their cost and traffic impact, or let organisations monetise AI-generated traffic.