Governments and major corporations across Asia and Europe have suspended online services and intensified cybersecurity measures after critical vulnerabilities in the PHP programming language triggered millions of hacking attempts.
The security scare has affected banking, aviation, railway, taxation and government services, highlighting the risks posed by weaknesses in software that powers a significant portion of the internet.
Cloud services provider Cloudflare reported a sharp surge in attempts to exploit the vulnerabilities following their public disclosure, prompting organisations to accelerate security updates and temporarily restrict access to potentially exposed systems.
Cloudflare Chief Executive Officer Matthew Prince said the company detected thousands of exploitation attempts in the 10 hours before the flaws were publicly announced.
According to him, the attempts rose to tens of thousands within 45 minutes of the announcement, reached hundreds of thousands within two hours and subsequently climbed into the millions.
The vulnerabilities prompted PHP developers to release security fixes on Wednesday, urging users to update their systems immediately.
The flaws, which had reportedly remained undetected for years, were uncovered with the assistance of artificial intelligence, raising concerns about how emerging technologies could enable security researchers and malicious actors to identify and exploit weaknesses in widely used software.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said the disclosure of the vulnerabilities before fixes were ready had intensified the race between defenders and attackers.
“Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.
Microsoft Chief Executive Officer Satya Nadella also highlighted the importance of developing software that can be maintained securely as digital systems become increasingly complex.
“I’ve not seen anything like this in a long, long time,” Nadella said at an event in Germany.
In Japan, several major companies temporarily suspended selected online services as part of precautionary measures.
They included brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway. Asahi Group Holdings also suspended certain websites and systems while assessing the potential security impact, while Tokio Marine Holdings temporarily took down its group website.
The Japanese Ministry of Finance, Meteorological Agency and National Tax Agency also restricted or suspended some online services while implementing protective measures.
The incidents have intensified concerns about Japan’s cybersecurity preparedness. Data from TrendAI cited in the report indicated that the country recorded more cyber incidents in the first nine months of the year than throughout the previous year.
In Europe, French telecommunications company Orange temporarily restricted access to certain PHP-based websites and applications across several subsidiaries.
Finland’s state IT services provider, Valtori, said it had installed security patches overnight and was gradually restoring government web services after imposing precautionary restrictions a day earlier.
Valtori Director General Hannu Naumanen warned that restoring affected services could take days or weeks because systems would require thorough testing after updates.
The agency said the service interruptions were precautionary and that it had no evidence the vulnerabilities had been exploited to cause the outages or that a cyber breach had occurred.
Asian governments have also stepped up their responses. China’s industry ministry urged organisations to inspect their systems, install the latest secure PHP versions and strengthen cybersecurity monitoring. It also recommended changing account credentials, passwords and security keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures amid concerns about an increased risk of attacks.
Meanwhile, Tencent Cloud, one of China’s largest cloud-computing providers, advised customers to install updated PHP versions but did not call for widespread website shutdowns.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many large operators had already applied updates, while smaller organisations and operators of complex systems could face longer delays.
He warned that some website operators might be running outdated PHP versions without regularly monitoring their security status.
Where older versions no longer receive security updates, he said, operators could be forced to upgrade their underlying systems to protect against potential attacks.
The incident has renewed concerns about the security of widely used internet infrastructure, particularly as organisations face pressure to close vulnerabilities before attackers can exploit them on a large scale.
