Global cybersecurity alert: PHP flaws trigger website shutdowns as hack attempts surge into millions

A global cybersecurity emergency has forced governments and major companies to patch critical vulnerabilities in PHP, a programming language used to run websites and online services. The flaws, reportedly uncovered using artificial intelligence (AI), triggered precautionary shutdowns in several countries as attempts to exploit them surged into the millions.

The affected services range from banking and airline websites to government portals. The scale of the response highlights how a weakness in widely used software can threaten digital services across multiple industries at once.

Cloudflare reports millions of attempts to exploit PHP flaws

Cloudflare CEO Matthew Prince described a sharp rise in activity after details of the vulnerabilities became public. He said the company observed thousands of exploitation attempts in the 10 hours before the public announcement. That rose to tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.

Amazon also reported widespread exploitation activity, although the information provided does not establish how many attacks succeeded or how many organisations suffered breaches. The concern is that attackers may use AI to identify weaknesses and develop exploits faster than organisations can update vulnerable systems.

PHP developers released security fixes on Wednesday and urged users to update immediately. However, applying a patch can be difficult for organisations running older or highly customised software.

Japan, France and Finland suspend online services

The response has been particularly visible in Japan, where companies and government agencies temporarily restricted access to some services.

Affected organisations included Nomura, Mitsubishi UFJ Financial Group, ANA, East Japan Railway and Asahi Group Holdings. Japan's Ministry of Finance, Meteorological Agency and National Tax Agency also temporarily restricted certain online services.

French telecoms group Orange suspended access to selected PHP-based websites and applications across several subsidiaries as a precaution.

Finland's state IT services provider, Valtori, shut down government public web services before beginning to restore access after installing security patches. It said the outages were precautionary, adding that it was not aware of active exploitation of the flaws.

Microsoft CEO Satya Nadella described the incident as an exceptional challenge for IT and security teams, highlighting the need to build software that can be maintained securely as systems become more complex.

Why fixing the vulnerabilities could take weeks

Installing a security update is not always a simple process. Large organisations must identify affected systems, test patches and check that critical services continue working afterwards.

Older websites can pose a greater challenge. If a system uses a PHP version that no longer receives security updates, operators may need to upgrade the underlying software rather than install a quick fix.

China urged organisations to inspect their systems and install secure PHP versions, while South Korea raised its private-sector cybersecurity alert level.

For users, temporary website outages do not necessarily mean their data has been stolen. Some organisations have restricted access specifically to reduce risk while they investigate and apply fixes. The immediate priority is to secure exposed systems. The broader lesson is that software used across the internet can become a global point of weakness when critical flaws emerge and that fixing them may take considerably longer than attackers need to begin probing for openings.