TBPN · Oct 22, 2026 · 29m · 23m saved
With Matthew Prince, Co-Founder and CEO of Cloudflare
Photo: TechCrunch, CC BY 2.0 via Wikipedia
A flaw in the programming language behind roughly 70% of the web went from a quiet, two-month fix to "millions of attacks per minute" once the patch leaked.
Most companies would have announced a win like that. Matthew Prince, co-founder and CEO of Cloudflare, told TBPN's hosts that Cloudflare rolled out free protection to every customer — including the free tier — and said nothing about it until a leak forced the issue 36 hours before this interview.
"AI is not the bad guy here. AI is the good guy. The AI didn't create these vulnerabilities. AI found them." — Matthew Prince
Matthew's own company sat in the middle of the spike he's describing: Cloudflare's network is what absorbed the jump from thousands of attacks before the patch to millions a minute after it leaked.
The full interview is covered here so you can skip it. 29 minutes of audio, 6 minutes of reading.
Here are the 6 numbers that matter.
Key Takeaways
A PHP flaw used by about 70% of the web triggered a two-month, mostly secret fix across Cloudflare, Google, OpenAI, Automattic and the U.S. government
Cloudflare quietly protected every customer, including the free tier, before any of it was public
Once the patch leaked, attacks jumped from thousands to "millions of attacks per minute"
The NSA says taking an unpatched server offline is safer than running it exposed
A root-certificate operator ran critical infrastructure on a password "less secure than your ATM pin"
Matthew calls AI "the good guy" here — it found the vulnerabilities, it didn't create them
He predicts AI agent traffic could run 1,000 times human traffic within five years
The internet "almost collapsed" when COVID merely doubled traffic
His fix for the internet's business model is micropayments, a fraction of a cent per visit
1. PHP's 70% Problem
Matthew opened by explaining why a flaw in PHP mattered so much: the language quietly runs most of the web.
"About 70% of the web uses [PHP]. Popular CMS services like WordPress are built on top of PHP." — Matthew Prince
The flaw was a remote-code-execution bug — a hole that let an outsider run their own commands on any server still running unpatched PHP, including sites built on WordPress. OpenAI's own models, working with outside security researchers, found it and reported it to Cloudflare about two months before this interview. Google's Wiz team found and disclosed a second PHP flaw soon after. Once inside a server, an attacker could read every file on it and watch anything typed into it.
"You could read all the files on the server. You could spy on anything... if someone's typing in usernames and passwords on a website and you'd taken over the server, you'd be able to see those usernames and passwords." — Matthew Prince
