Global Tech Giants and Governments Scramble to Patch Critical PHP Flaws Amid Surge in AI-Driven Hacking Attempts

Global firms and governments raced against the clock to patch critical security flaws in the PHP programming language that underpins a vast portion of the modern internet. Major cloud infrastructure providers reported an unprecedented surge in malicious hacking attempts almost immediately after the severe vulnerabilities were publicly disclosed.

The frantic push to secure digital architecture followed coordinated actions by governments in Europe and other regions, which took prominent websites completely offline as a precautionary measure while website operators scrambled to secure vulnerable systems running the foundational software. These emergency shutdowns impacted critical infrastructure, interrupting banking, airline, rail, tax, and government services from Tokyo to Helsinki.

The widespread disruptions mark one of the most dramatic and challenging tests of the decades-old programming tools that quietly keep the web running, exposing how deeply modern governments and global enterprises depend on underlying code that very few people truly understand or actively monitor.

“I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at an event in Germany on October 21. He noted that the unfolding incident starkly demonstrates the critical importance of building software that can be maintained securely as digital systems grow increasingly complex. “It was a long day and a long night, I know, for all the IT and security folks.”

PHP KEY TO INTERNET’S FOUNDATIONS LIKE HTML, PYTHON

The developers of PHP—a foundational computing language comparable to HTML and Python—rushed to release emergency fixes on October 20 to address vulnerabilities that had lurked undetected in the software for years. These deep-seated security gaps were ultimately uncovered using advanced artificial intelligence tools. Following the discovery, software developers urgently urged users across the globe to update their systems immediately.

Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, explained that critical technical details of the flaws unfortunately became public before robust patches were fully ready for deployment, leading to an immediate wave of opportunistic attacks. “Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.

As enterprises and government bodies frantically deployed emergency patches and suspended web services as a precaution, automated hacking attempts surged into the millions, according to data released by cloud services firms Cloudflare and Amazon.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on the social media platform X late on Wednesday. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.” Amazon similarly confirmed that its threat intelligence networks had identified widespread exploitation attempts prior to the public disclosure.

IMPACT FROM JAPAN TO FINLAND

The ripple effects of the vulnerability were felt intensely across the Asia-Pacific region. Japanese companies, including major brokerage Nomura, banking giant Mitsubishi UFJ Financial Group, ANA airline, and East Japan Railway, announced on October 21 that they were temporarily suspending a variety of internet services as part of emergency defensive measures.

Brewer Asahi Group Holdings similarly chose to temporarily suspend certain public-facing websites and internal systems while conducting a comprehensive security impact assessment. Major insurer Tokio Marine Holdings confirmed that it had taken down its group website as a precaution.

Meanwhile, official government bodies in Japan also took drastic actions. The Ministry of Finance and the Meteorological Agency partially suspended online public services to implement essential safety measures, while Japan’s National Tax Agency temporarily took down its primary digital service portal.

These precautionary shutdowns highlight Japan’s growing and profound concerns over cybersecurity threats. According to data compiled by TrendAI, the country has recorded significantly more cyber incidents in the first nine months of this year than it did throughout the entirety of the previous year.

The defensive posture extended to Europe as well. French telecoms group Orange announced that it had temporarily suspended access to certain PHP-based websites and applications across several of its international subsidiaries as a strict precautionary measure.

In China, Tencent Cloud, one of the nation’s largest cloud-computing providers, strongly urged its customers to install updated and secure PHP versions immediately, though it stopped short of calling for widespread, mandatory website shutdowns.

In Finland, state-owned IT services provider Valtori reported that it continued installing critical PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public web services just a day earlier.

“Restoring services can days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said in an official statement. Valtori emphasized that the outages across Finland were not caused by the actual exploitation of the vulnerabilities or by any malicious cyber breach, adding that the agency was not aware of any active exploitation of the flaws on its domestic network.

SOME FIXES MAY TAKE WEEKS TO IMPLEMENT

The severity of the crisis prompted several Asian governments to order mandatory cybersecurity inspections related to the PHP vulnerabilities on Thursday.

China’s industry ministry urgently called upon organizations and individual users to thoroughly inspect their internal systems and upgrade immediately to the latest secure version of PHP. The ministry also recommended strengthening continuous cybersecurity monitoring and proactively changing user accounts, system passwords, and cryptographic keys wherever necessary.

In neighboring South Korea, authorities raised the private-sector cybersecurity alert level and activated emergency response protocols, citing growing concerns over a drastically increased risk of automated hacking attacks targeting vulnerable enterprises.

Felix Kuhlenkamp, head of security at the German digital industry association Bitkom, noted that while many larger technology operators had already managed to carry out the necessary updates, the process would inevitably take much longer for organizations managing complex IT systems and for smaller entities.

“They may run a website using PHP but don’t really keep a close eye on it,” he said, pointing to the underlying systemic risks. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.”