TOKYO/BEIJING/AMSTERDAM — Global companies and governments raced on Thursday to patch critical vulnerabilities in PHP, the decades-old programming language that underpins much of the internet, as cloud providers reported a surge in hacking attempts following the public disclosure of the flaws.

The emergency response began after governments in Europe and elsewhere took websites offline as a precaution on Wednesday, while website operators scrambled to secure systems running the widely used software.

The shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki marked one of the most dramatic tests of the tools that keep the web running, exposing how deeply governments and companies depend on code that few people fully understand.

“I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at an event in Germany on Thursday, adding that the incident underscored the importance of building software that can be maintained securely as systems grow more complex. “It was a long day and a long night, I know, for all the IT and security folks.”

PHP: Key to the Internet’s Foundations

The developers of PHP — a computing language on par with HTML and Python — released fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using artificial intelligence. They urged users to “update immediately.” The runs on web servers to generate dynamic pages and applications, so a flaw in its core code can potentially affect any site or service built with it.

Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws had become public before fixes were ready, and attacks have been reported since.

“Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.

As organizations deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firms Cloudflare and Amazon.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late on Wednesday. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Amazon also said it observed widespread exploitation. The escalation Prince described illustrates the window Lawrence flagged: between public disclosure and completed patching, systems still running vulnerable code remain exposed.

Impact From Japan to Finland

Japanese companies including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as part of emergency measures.

Brewer Asahi Group Holdings temporarily suspended certain websites and systems while conducting a security impact assessment, and insurer Tokio Marine Holdings said it suspended its group website.

Japan’s Ministry of Finance and its Meteorological Agency partially suspended online services to implement safety measures, while the National Tax Agency temporarily took down its service.

The precautionary shutdowns reflect Japan’s growing concerns over cybersecurity. The country recorded more cyber incidents in the first nine months of this year than in all of last year, according to data from TrendAI.

Elsewhere, French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution. Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions but stopped short of calling for widespread website shutdowns.

Finland’s state IT services provider Valtori said it had continued installing PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public web services a day earlier.

“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said in a statement.

Valtori said the outages were not caused by exploitation of the vulnerabilities or by a cyber breach, and that it was not aware of any active exploitation of the flaws.

Some Fixes May Take Weeks

Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday. China’s industry ministry urged organizations and users to inspect their systems and upgrade to the latest secure version of PHP, and recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.

South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns over an increased risk of hacking attacks.

In Germany, Felix Kuhlenkamp, head of security at digital industry association Bitkom, said many larger operators had already carried out updates, but complex IT systems and smaller organizations could take longer.

“They may run a website using PHP but don’t really keep a close eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.”

From here, the clearest signals of how the episode plays out will be whether exploitation attempts hold at the volumes cloud providers are reporting, and how quickly suspended services return as updates and testing are completed.

— Reuters

Source: BusinessWorld