Millions of hacking attempts as companies, governments rush to patch PHP flaws
Cybersecurity inspections related to the vulnerabilities have been ordered in several Asian countries
[TOKYO/BEIJING] Companies and governments worldwide rushed on Thursday (Oct 22) to patch critical flaws in the widely used PHP programming language, as a cybersecurity company reported millions of hacking attempts after the vulnerabilities were disclosed.
The push came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday, while website operators scrambled to secure systems running the software.
The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki showed how much public and corporate systems rely on the software, and how hard it is to fix such flaws quickly once they are made public.
“It was a long day and a long night, I know, for all the IT and security folks,” said Microsoft CEO Satya Nadella said at a company event in Germany on Thursday. “I’ve not seen anything like this in a long, long time.”
He added that the episode underscores the importance of building digital systems that can be maintained securely.
PHP developers released urgent fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using artificial intelligence, urging users to “update immediately”.
“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security.
“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”
As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare.
In an X post late on Wednesday, Cloudflare CEO Matthew Prince said there were “thousands of attempts” to exploit the vulnerabilities in the 10 hours before it was made public.
“That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within two hours, and millions now.”
Disruptions around the world
Japanese companies including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said on Thursday they were temporarily suspending some Internet services as part of emergency measures.
Insurer Tokio Marine Holdings said it had suspended the website of a group company.
Japan’s Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures, while Japan’s National Tax Agency temporarily took down its service.
The precautionary shutdowns underscore growing concerns over cybersecurity in Japan, which recorded more cyber incidents in the first nine months of the year than in all of 2025, data from TrendAI showed.
French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.
Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions, but stopped short of calling for widespread website shutdowns.
Finland’s state IT services provider Valtori said it had continued installing PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public Web services a day earlier.
“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori director-general Hannu Naumanen said in a statement.
The provider said the outages were not caused by exploitation of the vulnerabilities or by a cyberbreach, and that it was not aware of any active exploitation of the flaws.
Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
China’s Ministry of Industry and Information Technology urged organisations and users to inspect systems immediately and upgrade to the latest secure version of PHP.
It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns over an increased risk of hacking attacks. REUTERS
Decoding Asia newsletter: your guide to navigating Asia in a new global order. Sign up here to get Decoding Asia newsletter. Delivered to your inbox. Free.
Share with us your feedback on BT's products and services
