Millions of Hacking Attempts Reported as Companies and Governments Race to Patch Security Flaws

Global companies and governments scrambled on Thursday to address critical vulnerabilities in the PHP programming language, which powers a significant portion of the internet, after a cloud services provider reported millions of hacking attempts following the public disclosure of the flaws.

The urgent response followed precautionary website shutdowns across Europe and other regions on Wednesday, as operators worked to secure systems running the software. Temporary disruptions affected banking, airline, railway, tax and government services from Tokyo to Helsinki. The incident has emerged as a major test of the decades-old programming technology underpinning much of the web, highlighting the widespread dependence of governments and businesses on complex software systems.

Microsoft CEO Satya Nadella described the situation as an unusually serious cybersecurity challenge while speaking at an event in Germany on Thursday. He said the incident underscored the importance of developing software that can be maintained securely as technology systems become increasingly complex.

"I've not seen anything like this in a long, long time," Nadella said, acknowledging the difficult work faced by IT and cybersecurity teams.

PHP Vulnerabilities Expose Internet's Security Risks

Developers of PHP, a widely used programming language that supports numerous websites and applications, released security updates on Wednesday to address vulnerabilities that had remained undetected for years. The flaws were reportedly discovered with the assistance of artificial intelligence (AI), prompting developers to urge users to install the updates immediately.

Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said information about the vulnerabilities became public before security fixes were available, leaving organizations exposed to potential attacks.

"Companies are racing to update against attackers who can use AI to exploit them. That's the whole race," she said.

As businesses and government agencies installed security patches and temporarily restricted access to websites, reported hacking attempts increased sharply, according to cloud services provider Cloudflare.

Cloudflare CEO Matthew Prince said in a post on X late Wednesday that the company had detected thousands of attempts to exploit the vulnerabilities during the 10 hours before their public disclosure.

The volume then climbed rapidly, reaching tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and millions afterward, Prince said.

Disruptions Spread From Japan to Finland

Several major Japanese companies announced temporary suspensions of online services on Thursday as part of emergency cybersecurity measures. They included brokerage firm Nomura, financial services group Mitsubishi UFJ Financial Group, airline All Nippon Airways (ANA) and East Japan Railway.

Asahi Group Holdings, one of Japan's leading beverage companies, temporarily suspended selected websites and systems while assessing the potential security impact. Insurer Tokio Marine Holdings also suspended its group website.

Government agencies took similar precautions. Japan's Ministry of Finance and Meteorological Agency restricted some online services, while the National Tax Agency temporarily shut down its online service.

The measures reflect Japan's growing concerns about cyber threats. According to data from TrendAI, the country recorded more cyber incidents during the first nine months of the year than throughout the previous year.

French telecommunications company Orange also temporarily restricted access to certain PHP-based websites and applications across several subsidiaries as a precaution.

Tencent Cloud, one of China's largest cloud computing providers, urged customers to upgrade to secure PHP versions but did not recommend widespread website shutdowns.

In Finland, state IT services provider Valtori continued installing security patches overnight and began gradually restoring public online services after precautionary restrictions imposed a day earlier.

Valtori Director General Hannu Naumanen warned that restoring services could take several days or even weeks because systems must undergo thorough testing after updates.

The agency clarified that the outages were precautionary and had not resulted from a successful cyberattack or exploitation of the vulnerabilities. It also said it had no knowledge of active exploitation of the flaws at that time.

Asian Governments Order Cybersecurity Checks

Several Asian governments ordered cybersecurity inspections on Thursday in response to the PHP vulnerabilities.

China's Ministry of Industry and Information Technology urged organizations and individual users to examine their systems and upgrade to the latest secure PHP versions. It also recommended strengthening security monitoring and changing account credentials, passwords and cryptographic keys where necessary.

South Korea raised its cybersecurity alert level for the private sector and activated emergency response measures amid concerns that the vulnerabilities could increase the risk of hacking attacks.

Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many large organizations had already implemented updates, but smaller businesses and operators of complex IT systems could face greater difficulties.

Some website operators may use PHP without regularly monitoring or maintaining their software, he explained.

Websites running outdated PHP versions that no longer receive security updates could require a broader system upgrade rather than a simple patch, Kuhlenkamp added.

Updating Older Systems Could Take Weeks

The incident has highlighted the challenges organizations face in securing legacy software that remains essential to internet operations. Although security patches are available, installing them across complex systems can require extensive testing and coordination.

For organizations running unsupported PHP versions, the process may be particularly demanding, as upgrading could involve changes to the wider IT infrastructure.

The rapid surge in reported exploitation attempts also demonstrates how quickly attackers can respond when details of a software vulnerability become public, particularly when AI tools can help identify potential weaknesses.

With companies and governments racing to secure affected systems, cybersecurity teams face the difficult task of balancing the need to restore online services with the risks of bringing vulnerable systems back into operation.