PHP SECURITY FLAWS TRIGGER GLOBAL CYBER ALERT AS HACKING ATTEMPTS SURGE INTO THE MILLIONS
October 22, 2026
TOKYO/BEIJING, OCTOBER 22, 2026 — A wave of cyberattack attempts has intensified worldwide following the public disclosure of critical vulnerabilities in PHP, a programming language widely used to operate websites and online services. Cloud services company Cloudflare reported a dramatic escalation in attempts to exploit the flaws, while businesses and governments raced to secure vulnerable systems and deploy emergency software updates.
Cloudflare Chief Executive Matthew Prince said the company detected thousands of exploitation attempts across its network during the ten hours before the vulnerabilities were publicly announced. The figure climbed to tens of thousands within 45 minutes of disclosure, reached hundreds of thousands within two hours and subsequently rose into the millions.
The vulnerabilities had reportedly remained undetected for years before being identified with the assistance of artificial intelligence. PHP developers issued urgent security fixes on Wednesday and called on users to update their software immediately. However, the public disclosure of technical details before fixes were ready created a window of opportunity for attackers to attempt exploitation.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said organisations were racing to update their systems while facing attackers who could use artificial intelligence to exploit the newly disclosed weaknesses.
The security emergency prompted precautionary suspensions of online services across several countries, highlighting the extensive dependence of public institutions and private businesses on PHP-based infrastructure. Banking, transport, taxation and government services were among the systems affected by emergency protective measures.
In Japan, major companies including brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway announced temporary suspensions of certain internet services. Tokio Marine Holdings also suspended the website of a group company. Japan's Finance Ministry, Meteorological Agency and National Tax Agency partially or temporarily restricted online services as they introduced security precautions.
French telecommunications group Orange temporarily suspended access to selected PHP-based websites and applications across several subsidiaries. In Finland, state IT services provider Valtori continued installing security patches after taking government public websites offline the previous day. The organisation subsequently began gradually lifting its precautionary restrictions.
Valtori Director General Hannu Naumanen cautioned that restoring services could take days or weeks because systems must be carefully tested after updates are installed. The provider said the outages were precautionary, not the result of exploitation of the vulnerabilities or a confirmed cyber breach, and that it was unaware of active exploitation of the flaws.
China's Tencent Cloud urged customers to install updated PHP versions but stopped short of recommending widespread website shutdowns. China's industry ministry instructed organisations and individual users to inspect their systems promptly, upgrade to secure software versions and strengthen cybersecurity monitoring. It also recommended changing account credentials, passwords and keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures amid concerns about a possible increase in hacking activity. The response across Asia followed similar precautions in Europe, where some public-facing government services had been taken offline while operators worked to address the vulnerabilities.
Microsoft Chief Executive Satya Nadella said the episode had underscored the importance of designing digital systems that can be maintained securely. He described the period as an exceptionally demanding one for information technology and security professionals.
The incident demonstrates the difficulties organisations face when critical software weaknesses become public before all affected systems can be secured. With exploitation attempts rising rapidly, technology teams are confronting the dual challenge of applying urgent fixes and ensuring that restored websites and services remain safe and reliable.
