Companies and governments around the world raced to secure critical vulnerabilities in the widely used PHP programming language on Thursday, as hacking attempts surged into the millions and emergency website shutdowns exposed the fragility of the digital infrastructure underpinning modern economies.
The scramble followed the disclosure of flaws that had remained hidden in the software for years before being uncovered with the help of artificial intelligence. Within hours of the vulnerabilities becoming public, organisations were confronting a race against attackers to install fixes, isolate exposed systems and determine whether essential services could remain online safely.
The disruption stretched from Tokyo to Helsinki, with banks, airlines, rail operators, tax authorities and government agencies suspending some internet services as a precaution. The response highlighted both the extensive reliance on PHP and the difficulty of securing interconnected systems once a serious weakness becomes public knowledge.
“It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time,” Microsoft chief executive Satya Nadella said at a company event in Cologne, Germany, on Thursday.
Nadella said the episode underscored the importance of building digital systems that could be maintained securely — a challenge made more pressing as AI accelerates the discovery of software weaknesses and potentially gives attackers new ways to exploit them.
PHP developers issued urgent security fixes on Wednesday and urged users to “update immediately”. But the timing of the disclosure left organisations scrambling to protect systems while malicious actors were already probing for vulnerable targets.
“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity company Aikido Security.
“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”
The speed of the escalation was reflected in data from Cloudflare, the cloud services provider that monitors and protects internet traffic. Its chief executive, Matthew Prince, said attempts to exploit the vulnerabilities had climbed from thousands to millions in a matter of hours.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Prince wrote on X late on Wednesday.
“That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”
The figures illustrate the shrinking window organisations may have to respond when vulnerabilities become public. Security teams must identify affected systems, deploy patches and test changes, all while assessing whether attackers have found a way in.
In Japan, a series of prominent companies and public bodies temporarily suspended online services as part of emergency measures. Brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway were among those reporting suspensions. Insurer Tokio Marine Holdings said it had taken the website of a group company offline.
The Ministry of Finance and the Japan Meteorological Agency also partially suspended online services, while the National Tax Agency temporarily took down its service.
The disruption comes amid mounting concern about Japan’s exposure to cyber threats. Data from TrendAI showed the country recorded more cyber incidents in the first nine months of the year than during the whole of the previous year.
In Europe, French telecoms group Orange temporarily restricted access to certain PHP-based websites and applications across several subsidiaries. China’s Tencent Cloud urged customers to install updated versions of PHP, although it stopped short of recommending widespread website shutdowns.
Finland’s state IT services provider Valtori, which had shut down government public web services a day earlier, said it continued installing patches overnight and was gradually lifting precautionary restrictions.
“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” said Valtori director-general Hannu Naumanen.
The organisation said the outages had not been caused by exploitation of the vulnerabilities or a cyber breach, and that it was not aware of any active exploitation of the flaws.
That distinction is critical: precautionary shutdowns are evidence of the perceived risk, not proof that systems have been compromised.
The broader challenge is that software vulnerabilities rarely exist in isolation. A single widely used component can sit beneath thousands of websites and services, creating a common point of exposure across organisations with vastly different security budgets and capabilities.
AI adds a new dimension to that risk. Tools that help researchers identify flaws can also shorten the path from disclosure to attempted exploitation, putting pressure on companies to patch systems faster than traditional maintenance processes may allow.
For governments and businesses, the immediate priority is to install the available fixes and verify that systems are secure before restoring services. The longer-term lesson is more difficult: digital resilience depends not only on preventing attacks, but also on knowing where critical software runs, how quickly it can be updated and whether it can be safely taken offline when the threat demands it.
The PHP incident has turned that challenge into an urgent operational test — one in which the time between discovering a weakness and exploiting it may be measured in hours, rather than days.
Leave a Comment