As governments race to fix PHP flaws, global hacking attempts surge

Image- Collected

Companies and governments worldwide are rushing to patch critical vulnerabilities in PHP, a programming language used across much of the internet, after cloud providers reported a sharp rise in hacking attempts following the flaws’ disclosure.

Several governments and businesses took websites and online services offline on Wednesday as a precaution while working to secure systems running vulnerable versions of the software.

The disruptions affected banking, airline, railway, tax and government services across countries from Japan to Finland, highlighting the widespread dependence on PHP-based systems.

Microsoft CEO Satya Nadella described the incident as an exceptional challenge for IT and security teams, stressing the importance of developing software that can be maintained securely as systems become more complex.

PHP developers released security fixes on Wednesday for vulnerabilities that had remained undetected for years and were reportedly discovered using artificial intelligence. They urged users to update their systems immediately.

Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws became public before fixes were ready, allowing attackers to begin exploiting them.

Cloudflare CEO Matthew Prince reported a rapid escalation in attempted attacks. The company observed thousands of exploitation attempts in the 10 hours before public disclosure, rising to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterwards. Amazon also reported widespread exploitation attempts.

In Japan, companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily suspended some online services. Asahi Group Holdings and Tokio Marine Holdings also restricted access to certain websites and systems. Government agencies, including the Finance Ministry, Meteorological Agency and National Tax Agency, implemented precautionary shutdowns.

French telecom operator Orange temporarily restricted access to some PHP-based websites and applications across several subsidiaries. China’s Tencent Cloud urged customers to install updated PHP versions, while Finland’s state IT provider Valtori continued applying security patches and gradually restoring services after taking government websites offline.

Valtori said the outages were precautionary and not the result of a cyber breach, adding that it had no evidence of active exploitation of the vulnerabilities. Its director general, Hannu Naumanen, warned that restoring services could take days or weeks because systems must be thoroughly tested after updates.

Several Asian governments also stepped up cybersecurity measures. China’s industry ministry urged organisations to upgrade PHP, strengthen monitoring and change accounts, passwords and keys where necessary. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures.

Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many large operators had already installed updates, but smaller organisations and complex systems could take longer. Websites running outdated PHP versions without available security updates may require broader system upgrades.