AI Helped Uncover PHP’s Hidden Flaws. Now Hackers Are Racing to Exploit Them.

Companies and governments worldwide scrambled today to secure systems running the PHP programming language after the disclosure of critical vulnerabilities triggered millions of hacking attempts, highlighting the cybersecurity risks facing organisations reliant on widely used software.

Cloud services firm Cloudflare reported a rapid escalation in attempts to exploit the flaws after details became public, as organisations across Europe and Asia deployed emergency security patches and temporarily suspended online services to limit potential exposure.

The vulnerabilities prompted precautionary shutdowns of government websites and services linked to banking, airlines, railways and tax authorities on Wednesday, disrupting access to digital infrastructure from Japan to Finland.

“It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at a company event in Cologne, Germany.

He said the episode underscored the importance of building digital systems that can be maintained securely.

PHP developers released emergency fixes on Wednesday for vulnerabilities that had remained undetected in the software for years before being uncovered using artificial intelligence, urging users to “update immediately”.

“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security.

“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”

Cloudflare CEO Matthew Prince said hacking attempts had surged from thousands before the vulnerabilities were publicly disclosed to millions afterwards.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Prince said in a post on X. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

SERVICES SUSPENDED ACROSS ASIA AND EUROPE

Japanese companies, including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway, said on Thursday they were temporarily suspending some internet services as part of emergency security measures.

Insurer Tokio Marine Holdings said it had suspended the website of a group company.

Japan’s Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures, while the National Tax Agency temporarily took down its service.

The precautionary measures come as cybersecurity threats intensify in Japan, which recorded more cyber incidents in the first nine months of the year than in all of last year, according to data from TrendAI.

French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.

Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions but stopped short of recommending widespread website shutdowns.

Finland’s state IT services provider Valtori said it continued installing security patches overnight and was gradually lifting precautionary restrictions after shutting down government public web services a day earlier.

“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said in a statement.

Valtori said the outages were not caused by exploitation of the vulnerabilities or a cyber breach, and that it was not aware of any active exploitation of the flaws.

Several Asian governments ordered cybersecurity inspections related to the vulnerabilities on Thursday.

China’s industry ministry urged organisations and users to inspect their systems immediately and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.

South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns about an increased risk of hacking attacks.

Stay ahead of the Stories shaping our world. Subscribe to Impact Newswire and join our 
WhatsApp Channel for updates on global tech, business, and innovation—all in one place.

Dive deeper into the future with the Cause Effect 4.0 Podcast, where we explore the ideas, trends, and technologies driving the global AI conversation.

Got a story to share? Contact Us to reach a global audience with Impact Newswire.