Companies and governments rush to patch critical PHP flaws as attacks reach the millions

A global scramble to patch

Hacking attempts against the PHP flaws surged into the millions as companies and governments deployed patches and suspended websites, according to Cloudflare ^[1]. Companies and governments worldwide rushed on Thursday to patch critical flaws in the widely used PHP programming language ^[1].

Governments in Europe and elsewhere took websites offline as a precaution on Wednesday ^[1]. PHP developers released urgent fixes on Wednesday and urged users to update immediately ^[1].

How the attacks grew

Cloudflare CEO Matthew Prince said the network saw thousands of attempts to exploit the flaw in the 10 hours before public announcement ^[1]. Attempts rose to tens of thousands in the 45 minutes after announcement, hundreds of thousands within 2 hours, and millions by the time of Prince's post ^[1].

Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws became public before fixes were ready, and attacks have since been reported ^[1]. The vulnerabilities had lurked in the software for years until they were uncovered using AI ^[1].

Microsoft CEO Satya Nadella said he had not seen anything like this in a long time ^[1]. He said the episode underscored the importance of building digital systems that can be maintained securely ^[1].

Japan suspends services

Japanese companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as emergency measures ^[1]. Insurer Tokio Marine Holdings said it had suspended the website of a group company ^[1]. Brewer Asahi Group Holdings temporarily suspended certain websites and systems and was conducting a security impact assessment ^[2].

Japan's Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures ^[1]. The National Tax Agency temporarily took down its service ^[1]. Prime Minister Sanae Takaichi urged website operators on Wednesday to check whether their systems used PHP and prepare to install the security fixes ^[3].

Japan recorded more cyber incidents in the first nine months of the year than in all of last year, according to TrendAI data ^[1].

Responses in Europe and Asia

French telecoms group Orange temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution ^[1]. Finland's state IT services provider Valtori shut down government public web services a day before the Thursday report and was gradually lifting precautionary service blocks ^[1]. Valtori said its outages were not caused by exploitation of the vulnerabilities or by a cyber breach, and it was not aware of any active exploitation of the flaws ^[1].

Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday ^[1]. China's industry ministry urged organizations and users to inspect systems immediately and upgrade to the latest secure version of PHP ^[1]. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary ^[1].

South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing an increased risk of hacking attacks ^[1]. The country's science ministry said the vulnerabilities could allow attackers to execute malicious commands without authentication, steal sensitive information or take websites offline ^[3]. Tencent Cloud urged customers to install updated PHP versions but stopped short of calling for widespread website shutdowns ^[1].