Companies and governments worldwide scrambled to secure systems running the PHP programming language on Thursday after the disclosure of critical vulnerabilities triggered a surge in attempted cyberattacks. Cloud services providers reported millions of exploitation attempts as organisations raced to install security fixes and prevent potential breaches.
The emergency response has included precautionary shutdowns of websites and online services in Europe and Asia, affecting banking, transport, airline, tax and government operations. The disruption has highlighted the dependence of major institutions on PHP, a longstanding programming language used across the internet.
Microsoft chief executive Satya Nadella described the incident as an unusually serious test of cybersecurity preparedness. Speaking at an event in Germany on Thursday, he said: “I’ve not seen anything like this in a long, long time.” He added that the incident demonstrated the importance of developing software that could be maintained securely as systems became more complex.
“It was a long day and a long night, I know, for all the IT and security folks,” Nadella said.
PHP developers released fixes on Wednesday for vulnerabilities that had remained undetected for years before being identified using artificial intelligence. They urged users to update their software immediately. However, cybersecurity experts warned that information about the flaws had become public before patches were available, giving attackers an opportunity to exploit vulnerable systems.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said attacks had been reported after details of the vulnerabilities emerged. “Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.
Cloudflare chief executive Matthew Prince reported a sharp escalation in attempted exploitation across the company’s network. In a post on X late on Wednesday, he said thousands of attempts had been recorded during the 10 hours before the vulnerabilities were publicly announced. The number rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and millions thereafter.
Amazon also reported widespread exploitation attempts, according to its security team.
In Japan, several major companies temporarily suspended online services as a precaution. They included brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway. Asahi Group Holdings suspended certain websites and systems while assessing the security impact, and Tokio Marine Holdings halted access to its group website.
Japan’s Ministry of Finance and Meteorological Agency partially suspended online services, while the National Tax Agency temporarily took down its service. The measures came amid broader concerns about cybersecurity incidents in the country.
French telecommunications group Orange also temporarily suspended access to certain PHP-based websites and applications across several subsidiaries. In Finland, state IT services provider Valtori shut down public government web services on Wednesday before beginning to lift restrictions as security patches were installed.
Valtori said the shutdowns were precautionary and had not resulted from exploitation of the vulnerabilities or a cyber breach. The organisation said it was unaware of any active exploitation of the flaws. Its director general, Hannu Naumanen, warned that restoring services could take days or weeks because systems needed careful testing after updates.
Governments across Asia also strengthened their responses. China’s industry ministry urged organisations to inspect their systems, install secure PHP versions and reinforce monitoring, recommending changes to accounts, passwords and keys where necessary. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many large operators had already applied updates, but smaller organisations and operators with complex systems could take longer. Websites running outdated PHP versions without available security updates might require an upgrade of the entire system, he said.
