BEIJING/AMSTERDAM, Oct 22 – Governments and businesses around the world are scrambling to secure their online systems after critical vulnerabilities were discovered in PHP, a programming language used extensively to operate websites and internet services. The urgency intensified on Thursday after Cloudflare reported a rapid increase in attempts to exploit the flaws, with activity climbing from thousands of incidents to millions following public disclosure.
The vulnerabilities have triggered emergency security measures across several countries, including the temporary suspension of banking, transportation, airline, taxation and government websites. Organisations are racing to install security updates, assess potential exposure and determine whether their systems can remain accessible without increasing the risk of a cyberattack.
The situation has highlighted the challenges of maintaining internet infrastructure built on software that has been used for decades. Although PHP developers released fixes on Wednesday, the global response has been complicated by the number of organisations relying on the language, the age of some systems and the time required to test updates before restoring services.
Microsoft Chief Executive Satya Nadella described the incident as an unusually serious challenge for technology and security teams. Speaking at an event in Germany on Thursday, he said he had not seen a situation of this kind for a long time, adding that the episode had made for a difficult day and night for information technology and cybersecurity professionals.
Nadella also stressed the importance of developing software that can be maintained securely as technology systems become increasingly complex. His comments reflected wider concerns about the ability of organisations to protect essential services when vulnerabilities emerge in widely used software.
Cloudflare Reports Rapid Increase in Exploitation Attempts
PHP is a widely used programming language that helps power websites and web applications. Its extensive adoption means that a weakness in the software can potentially affect a broad range of organisations, from private businesses to public institutions.
Developers released updated versions of PHP on Wednesday to address critical vulnerabilities that had remained undiscovered for years. The flaws were identified with the assistance of artificial intelligence, raising questions about how AI tools are changing the process of finding weaknesses in software and how quickly malicious actors can take advantage of newly disclosed information.
Madeline Lawrence, co-founder of Belgian cybersecurity company Aikido Security, said information about the vulnerabilities had become public before the necessary fixes were available. She said attacks had been reported since the details emerged, leaving organisations competing against attackers who could also use AI to exploit weaknesses.
The speed of that competition has become a central concern for security specialists. Once information about a vulnerability becomes publicly available, administrators must identify affected systems, determine which versions are running and apply appropriate patches. Attackers, meanwhile, may attempt to exploit vulnerable systems before those measures are completed.
Cloudflare, a major provider of cloud and internet security services, reported a sharp escalation in attempted exploitation. Chief Executive Matthew Prince said in a post on X late Wednesday that the company had detected thousands of attempts across its network during the 10 hours before the vulnerabilities were publicly announced.
According to Prince, the number increased to tens of thousands during the first 45 minutes after disclosure, reached hundreds of thousands within two hours and subsequently climbed into the millions.
The reported figures indicate the speed at which cybercriminals and other potential attackers can respond to information about a newly disclosed software weakness. However, attempted exploitation does not necessarily mean that an attack succeeded or that a targeted system was compromised.
The incident has also reinforced the importance of rapid communication between software developers, cybersecurity providers and organisations responsible for essential online services. Even when a security update is available, deployment can be difficult for operators managing older applications, interconnected systems or services that cannot be taken offline without disrupting customers.
Emergency Website Suspensions Spread From Japan to Europe
Japan has been among the countries where organisations have introduced precautionary measures in response to the PHP vulnerabilities. Several major companies announced temporary suspensions of online services on Thursday while assessing their exposure and implementing security measures.
Brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway were among the Japanese businesses that said they were temporarily suspending certain internet services. The measures affected sectors that depend on reliable digital access for financial transactions, travel information and customer services.
Asahi Group Holdings, the Japanese brewing company, temporarily suspended selected websites and systems while conducting a security impact assessment. Insurer Tokio Marine Holdings also said it had suspended its group website.
Government services were affected as well. Japan’s Ministry of Finance and Japan Meteorological Agency partially suspended online services while implementing safety measures. The National Tax Agency temporarily took its service offline.
The response comes as Japan faces growing cybersecurity pressures. Data from TrendAI indicated that the country recorded more cyber incidents during the first nine months of the year than throughout the previous year, adding to concerns about the risks facing organisations that rely on digital infrastructure.
In Europe, French telecommunications group Orange temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution. The action demonstrated that concerns were not confined to government departments or financial institutions, but also extended to major commercial technology operators.
China’s Tencent Cloud, one of the country’s largest cloud-computing providers, urged customers to upgrade to secure PHP versions. The company stopped short of recommending widespread website shutdowns, illustrating how organisations have adopted different approaches depending on their assessment of the risks and their ability to deploy fixes.
Finland also took precautionary action. Valtori, the state IT services provider, said it had continued installing PHP security patches overnight after government public websites were taken offline a day earlier. The organisation subsequently began gradually lifting restrictions as systems were updated.
Valtori Director General Hannu Naumanen warned that restoring services could take days or even weeks because updates must be followed by careful testing. The process is necessary to ensure that security measures do not introduce additional problems or interfere with the operation of public services.
The Finnish provider said the service interruptions had not resulted from exploitation of the vulnerabilities or a cyber breach. It also said it was not aware of any active exploitation of the flaws. That distinction is important because precautionary shutdowns can occur before an organisation has evidence that its systems have been attacked.
Governments Tighten Security Measures as Repairs Could Take Weeks
Authorities across Asia have intensified their responses, ordering inspections and urging organisations to review their systems. China’s industry ministry called on organisations and individual users to examine potentially affected systems and upgrade to the latest secure PHP versions.
The ministry also recommended strengthening cybersecurity monitoring and changing account credentials, passwords and cryptographic keys where necessary. Such measures can help reduce the risk of unauthorised access, particularly when administrators suspect that existing systems or credentials may have been exposed.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns that the vulnerabilities could lead to an increase in hacking attempts. The move added to a coordinated regional effort to identify exposure and limit the potential impact on businesses and public services.
However, installing patches is not equally straightforward for every organisation. Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many larger operators had already completed updates, while smaller organisations and operators of complex information technology systems could require more time.
Some businesses may operate PHP-based websites without closely monitoring the underlying software, Kuhlenkamp said. In cases where a website relies on an old PHP version that no longer receives security updates, the operator may need to upgrade the broader system rather than simply install a patch.
That requirement can create significant technical and operational challenges. Organisations must establish which applications depend on the affected software, check whether updates are compatible with existing systems and test whether services continue to function correctly. For large institutions, even a relatively narrow software change can require coordination across multiple departments and technology providers.
The consequences extend beyond the immediate disruption caused by taking websites offline. Prolonged outages can prevent customers from accessing financial services, disrupt travel arrangements and limit access to government information. At the same time, restoring systems too quickly without adequate testing could leave organisations exposed to security risks or introduce new operational failures.
The episode has placed renewed attention on the maintenance of widely used software and the importance of identifying vulnerabilities before they become public security emergencies. The involvement of artificial intelligence in discovering the PHP flaws adds another dimension to that challenge, as the same technological advances that can help researchers identify weaknesses may also enable attackers to act more quickly.
For now, organisations are balancing the need to restore online services with the need to establish that their systems are secure. While the release of PHP fixes has provided a route toward addressing the vulnerabilities, the scale of adoption, the presence of outdated software and the demands of testing mean that the response is unlikely to be completed everywhere at the same time.
The rapid rise in reported exploitation attempts serves as a warning about the speed at which cyber threats can develop when a weakness affects widely deployed technology. For governments and businesses, the immediate priority remains applying security updates, checking potentially exposed systems and restoring disrupted services only when the necessary safeguards are in place.