Global firms and governments raced on Thursday to patch critical flaws in PHP, a programming language that underpins much of the internet, as cloud service providers reported a surge in hacking attempts after the vulnerabilities were disclosed.
The scramble followed precautionary website shutdowns by governments in Europe and elsewhere on Wednesday, as operators rushed to secure systems running the software.
The emergency suspensions of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most serious tests in years for the decades-old software tools that keep the web running. They also expose how heavily governments and companies depend on code that few people understand.
“I’ve not seen anything like this in a long, long time,” Microsoft chief executive Satya Nadella said at an event in Germany on Thursday. The incident, he said, highlighted the importance of building software that can be maintained securely as systems become more complex.
“It was a long day and a long night, I know, for all the IT and security folks.”
PHP underpins much of the internet
PHP developers released fixes on Wednesday for vulnerabilities that had remained undetected in the software for years before being uncovered using artificial intelligence. They urged users to “update immediately”.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws had become public before fixes were ready, and attacks had been reported since.
“Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.
As companies and governments installed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud service providers Cloudflare and Amazon.
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare chief executive Matthew Prince said in a post on X late on Wednesday.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.”
Amazon also reported widespread attempts to exploit the vulnerabilities.
Services suspended from Japan to Finland
Japanese companies, including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway, said on Thursday they were temporarily suspending some online services as part of emergency measures.
Brewer Asahi Group Holdings temporarily suspended certain websites and systems while assessing the security impact. Insurer Tokio Marine Holdings said it had suspended its group website.
Japan’s Ministry of Finance and Meteorological Agency partially suspended online services to implement security measures, while the National Tax Agency temporarily took its service offline.
The precautionary shutdowns come as Japan faces growing cybersecurity concerns. The country recorded more cyber incidents in the first nine months of the year than in the whole of last year, according to data from TrendAI.
French telecommunications group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.
Tencent Cloud, one of China’s largest cloud computing providers, urged customers to install updated PHP versions but stopped short of calling for widespread website shutdowns.
Finland’s state IT services provider Valtori said it had continued installing PHP security patches overnight and was gradually lifting precautionary restrictions after shutting down public government websites a day earlier.
“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori director general Hannu Naumanen said in a statement.
Valtori said the outages had not resulted from exploitation of the vulnerabilities or a cyber breach, and that it was not aware of any active exploitation of the flaws.
Some fixes could take weeks
Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
China’s industry ministry urged organisations and users to inspect their systems and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing account credentials, passwords and keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns about an increased risk of hacking attacks.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many larger operators had already installed updates, but complex IT systems and smaller organisations could take longer to secure.
“They may run a website using PHP but don’t really keep a close eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.”