Matthew Prince

Stories

PHP vulnerabilities exploited as websites worldwide go offline

Said exploit attempts rose from thousands to millions, but none of Cloudflare's customers were affected

Millions of attempts to break into servers running PHP have produced no confirmed breach, according to security firms and government agencies. Nine companies, among them CrowdStrike, Palo Alto Networks and Sophos, told NBC News they had seen no successful attacks as of Thursday evening.

Updated Yesterday

Paris court spares Cloudflare's 1.1.1.1 from piracy blocking penalties

Rule Changes

Leads the company that won the Paris ruling

A Paris court has refused to fine Cloudflare for leaving its public DNS resolver 1.1.1.1 out of court-ordered piracy blocking. Canal+ wanted €50,000 a day for every pirate Formula 1 and MotoGP site that stayed reachable through the resolver.

Updated Oct 11

Internet concentration risk

Built World

Leading post-incident response and policy discussions

On February 16, 2026, a misconfigured routing update at Cloudflare's Ashburn data center cascaded across the internet, taking down X for three hours and degrading AWS's largest region. Thousands of other websites went down too. The error took 40 minutes to identify but four hours to fix because corrupted routing tables spread to upstream providers.

Updated May 29

The race to build AI's payment layer

Money Moves

Leading Cloudflare's AI economy strategy

For two years, AI companies have trained their models on web content without paying for most of it. That era may be ending.

Updated May 21

Cloudflare’s 2025 outages expose fragility in internet infrastructure

Built World

Publicly accountable for repeated outages through early 2026 and ongoing reliability reforms

From November 2025 through February 2026, Cloudflare suffered multiple major global outages, including a three-hour disruption on November 18, 2025, a 25–30 minute WAF misconfiguration incident on December 5, 2025, a BGP routing failure on January 22, 2026, and edge network instability on February 4, 2026. These events temporarily took down services like LinkedIn, Zoom, Shopify, Coinbase, ChatGPT, X, Spotify, and others that rely on Cloudflare's edge network, content delivery, and security services, affecting a significant portion of global HTTP traffic during peaks.

Updated May 9

Notable Quotes

In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

from PHP vulnerabilities exploited as websites worldwide go offline · Updated Yesterday

Automation got us into this, and automation alone could not get us out. — February 2026

from Internet concentration risk · Updated May 29

This was an unacceptable failure. We are implementing stronger safeguards including global kill switches for critical updates. — November 2025

from Internet concentration risk · Updated May 29

"Content creators deserve full control over their work, whether they want to write for humans or optimize for AI... The real goal has always been to help create a new economic model that actually works for the next phase of the Internet." — Cloudflare blog, January 2026

from The race to build AI's payment layer · Updated May 21

"The problem is that as the web shifts from a search-driven interface to an AI-driven interface, fewer and fewer people are going to consume the original content... And that means that the incentives for creating content go away." — Fortune, February 2025

from The race to build AI's payment layer · Updated May 21

"The Internet's next business model will be powered by pay-per-use, fractional payments, and microtransactions—tools that shift incentives toward original, creative content that actually adds value." — On x402 and NET stablecoin, January 2026

from The race to build AI's payment layer · Updated May 21