Global rush to patch PHP flaws as hacking attempts reach millions

Governments and companies worldwide rushed on Thursday to patch critical vulnerabilities in the PHP programming language, which underpins much of the internet, after cloud providers reported a surge in hacking attempts following public disclosure of the flaws.

The developers of PHP released fixes on Wednesday for vulnerabilities that had gone unnoticed for years until they were uncovered using AI, and urged users to update immediately. Madeline Lawrence, co-founder of Belgian cyber security firm Aikido Security, said details of the flaws became public before fixes were ready, with attacks reported since. She said companies were racing to update against attackers who can use AI to exploit them, describing it as the whole race.

Exploitation attempts escalated sharply. Cloudflare chief executive Matthew Prince said in a post on X that the network saw thousands of attempts in the 10 hours before public announcement, rising to tens of thousands within 45 minutes of it, hundreds of thousands within two hours and millions by late Wednesday. Amazon also said it observed widespread exploitation.

In Japan, brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said they were temporarily suspending some internet services as emergency measures. Brewer Asahi Group Holdings suspended certain websites and systems while assessing the security impact, and insurer Tokio Marine Holdings suspended its group website. Japan's Ministry of Finance and Meteorological Agency partially suspended online services, and the National Tax Agency temporarily took its service down. French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution, while China's Tencent Cloud urged customers to install updated versions.

Finland's state IT services provider Valtori said it had continued installing patches overnight and was gradually lifting precautionary blocks after shutting down government public web services. Director General Hannu Naumanen said restoring services could take days or even weeks because systems must be carefully tested, and that the outages were not caused by exploitation or a breach. China's industry ministry urged organisations to inspect systems and upgrade to the latest secure version of PHP, while South Korea raised its private-sector cyber security alert level. Microsoft chief executive Satya Nadella, speaking at an event in Germany, said he had not seen anything like it in a long time and that the incident showed the importance of building software that can be maintained securely.