Governments and companies rush to fix PHP flaws as hacking attempts reach millions

Cologne, Germany. Governments and businesses worldwide raced on Thursday to install fixes for critical vulnerabilities in PHP, a widely used programming language, as Cloudflare reported millions of hacking attempts. The response followed precautionary website closures on Wednesday by governments in Europe and other regions.

Disruptions span public and corporate services

Emergency suspensions affected services in banking, aviation, rail transport, taxation and government, stretching from Tokyo to Helsinki. The shutdowns highlighted the dependence of public institutions and businesses on PHP, alongside the difficulty of rapidly addressing vulnerabilities once details become public.

Website operators worked to protect systems using the software while companies and governments installed patches or temporarily took sites offline.

Years-old vulnerabilities discovered with AI

PHP developers issued emergency patches on Wednesday after artificial intelligence helped uncover vulnerabilities that had remained in the software for years. They urged users to install updates without delay.

Madeline Lawrence, a co-founder of Aikido Security, a Belgian cybersecurity company, said information about the weaknesses had become public before patches were available and that attacks had subsequently been reported. She described businesses as racing to update their systems against attackers able to exploit the flaws with AI.

Cloud services provider Cloudflare (NET.N) said attempted hacks had climbed into the millions as organisations responded. In a post on X late on Wednesday, CEO Matthew Prince said its network had detected thousands of exploitation attempts during the 10 hours preceding the public announcement.

Nadella stresses secure maintenance

Speaking at a company event in Cologne on Thursday, Microsoft CEO Satya Nadella described an unusually demanding day and night for IT and security teams, saying he had not witnessed a comparable episode for a long time.

He said the incident demonstrated why digital systems needed to be designed so they could be maintained securely.