Companies and governments worldwide are racing to secure systems running the PHP programming language after critical vulnerabilities triggered millions of reported hacking attempts.
Cloudflare, the cloud services and cybersecurity company, reported a sharp escalation in attempted exploits following the public disclosure of the flaws. The vulnerabilities prompted organisations to issue urgent software updates, while some governments and businesses temporarily took websites and online services offline as a precaution.
PHP is widely used to power websites and web applications, making vulnerabilities in the software a potential risk for organisations across multiple sectors.
The emergency response has highlighted how difficult it can be to secure widely deployed digital infrastructure once a serious software flaw becomes public.
Cloudflare CEO Matthew Prince described a rapid increase in attempted exploitation following the announcement of the vulnerabilities.
In a post on X, Prince said the company had observed thousands of attempts during the 10 hours before public disclosure. The number rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and millions thereafter.
Belgian cybersecurity firm Aikido Security said details of the flaws had become public before fixes were ready, leaving organisations racing to update their systems while attackers sought to exploit vulnerable installations.
PHP developers released emergency fixes on Wednesday and urged users to update immediately. The vulnerabilities had reportedly remained undiscovered for years before being identified using artificial intelligence.
The response has disrupted online services across several countries.
In Japan, companies including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway temporarily suspended some internet services. The Ministry of Finance, the Meteorological Agency and the National Tax Agency also partially or temporarily suspended online services as precautionary measures.
French telecoms group Orange restricted access to certain PHP-based websites and applications across several subsidiaries.
In Finland, state IT services provider Valtori shut down public government websites before beginning to restore access as security updates were installed and tested. The agency said the outages were precautionary and that it was not aware of active exploitation of the flaws or a resulting breach.
Tencent Cloud urged customers to install updated PHP versions, while authorities in China and South Korea strengthened cybersecurity measures and inspections.
Installing security updates is essential, but restoring services can take longer. Systems must be tested after patches are applied to ensure they remain secure and function correctly.
Valtori Director General Hannu Naumanen warned that restoration could take days or weeks, depending on the work required.
Microsoft CEO Satya Nadella said the episode underscored the importance of building digital systems that can be maintained securely.
The incident also highlights the risks associated with vulnerabilities in widely used software and the speed at which attackers can respond once technical details become public. With organisations relying on interconnected online services, rapid patching, monitoring and careful testing are critical to limiting exposure and restoring normal operations.