Governments and companies worldwide are rushing to fix critical security flaws in PHP, a programming language widely used to build websites, after cloud service providers reported a sharp increase in hacking attempts.
The vulnerabilities were disclosed on Wednesday, prompting several organisations to temporarily shut down websites and online services as a precaution while security teams worked to install updates.
The disruption affected services across multiple countries, including banking, airlines, railways, tax systems and government websites. The incident highlighted the risks faced by organisations that rely on older software to run their digital services.
AI Helped Identify Security Flaws
PHP developers released security updates on Wednesday and urged users to upgrade their systems immediately. The vulnerabilities had reportedly remained undiscovered for years before being identified with the help of artificial intelligence (AI).
However, security experts warned that information about the flaws became public before all affected systems could be secured, giving hackers an opportunity to attempt attacks.
Microsoft CEO Satya Nadella described the incident as a major challenge for IT and security teams, highlighting the importance of developing software that can be maintained securely as technology systems become more complex.
Hacking Attempts Reach Millions
Cloud service providers reported a significant rise in attempts to exploit the vulnerabilities after the information became public.
Cloudflare CEO Matthew Prince said the company initially detected thousands of attempts before the public announcement. The number then increased to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterward.
Amazon also reported widespread exploitation attempts, adding to concerns among organisations using PHP-based systems.
Companies and Governments Suspend Online Services
Several major organisations in Japan temporarily suspended online services while assessing the risks and implementing security measures.
These included brokerage firm Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway. Asahi Group Holdings and Tokio Marine Holdings also temporarily suspended certain websites or systems.
Japan’s Ministry of Finance, Meteorological Agency and National Tax Agency also restricted some online services as a precaution.
In Europe, French telecom company Orange temporarily suspended access to selected PHP-based websites and applications across several subsidiaries.
Finland’s government IT services provider, Valtori, continued installing security updates after temporarily shutting down public government websites. The organisation said it was gradually restoring services and that the outages were precautionary, not the result of a confirmed cyberattack.
Asian Countries Strengthen Cybersecurity Measures
Governments across Asia also issued warnings and ordered security checks.
China’s industry ministry asked organisations to inspect their systems, install secure PHP versions and strengthen cybersecurity monitoring. It also recommended changing account credentials and security keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures over concerns about increased hacking risks.
Meanwhile, cybersecurity experts warned that updating complex IT systems could take considerable time. Organisations running outdated PHP versions that no longer receive security updates may need to upgrade their underlying systems before they can fully address the vulnerabilities.
Security Updates Could Take Weeks
Although many large organisations have already started installing patches, smaller companies and operators running older websites could face longer delays.
Valtori said restoring some services could take days or weeks because systems must be carefully tested after security updates are installed.
The incident highlights the importance of regularly updating software, monitoring security threats and maintaining older IT systems. As PHP continues to support websites and online services worldwide, organisations are under pressure to address the vulnerabilities before attackers can exploit them further.
