Companies and governments worldwide are racing to secure their websites after the discovery of critical vulnerabilities in PHP, one of the internet's most widely used programming languages. Cybersecurity firm Cloudflare has reported millions of hacking attempts following the public disclosure of the flaws.
The cybersecurity emergency has forced organisations across Europe and Asia to temporarily shut down websites and online services as a precaution. Banking, aviation, railway, taxation and government services have been affected, highlighting the widespread dependence on PHP and the challenges of addressing security threats across complex digital infrastructure.
(PHP--an acronym for Hypertext Preprocessor--is a free, open-source, server-side scripting language explicitly designed for web development. It is the underlying engine that runs nearly 75% of all websites on the internet, powering major platforms like WordPress, Wikipedia, and Facebook.)
Cloudflare said attempts to exploit the vulnerabilities increased dramatically after details became public.
According to Cloudflare CEO Matthew Prince, the company detected thousands of exploitation attempts in the 10 hours before the public announcement. The number rose to tens of thousands within 45 minutes of the disclosure and hundreds of thousands within two hours, before eventually reaching millions.
PHP developers released emergency security updates on October 21 to address vulnerabilities that had remained undetected for years. The flaws were reportedly uncovered with the assistance of artificial intelligence (AI).
Security experts warn that publicly disclosed vulnerabilities can quickly become targets for cybercriminals, particularly as AI tools make it easier to identify weaknesses and automate attacks.
Organisations are being urged to install the latest security patches immediately to reduce their exposure.
Several major Japanese companies temporarily suspended online services on October 22 as part of emergency cybersecurity measures.
Financial institutions including Nomura and Mitsubishi UFJ Financial Group, along with airline ANA and East Japan Railway, announced precautionary service disruptions. Insurance group Tokio Marine Holdings also suspended a group company's website.
Japan's Ministry of Finance and Meteorological Agency partially suspended online services, while the National Tax Agency temporarily took its service offline to implement additional security measures.
The disruptions come amid growing cybersecurity concerns in Japan, where the number of cyber incidents recorded during the first nine months of 2026 reportedly exceeded the total for the whole of 2025.
The impact extended to Europe, where several government agencies and private businesses restricted access to websites and digital services.
French telecommunications company Orange temporarily suspended access to selected PHP-based websites and applications across several subsidiaries.
In Finland, government IT services provider Valtori continued installing security patches overnight after taking public-facing government services offline on October 21.
Asian governments have also stepped up their cybersecurity responses.
China's industry ministry urged organisations to inspect vulnerable systems immediately and upgrade to secure PHP versions. It also recommended closer security monitoring and replacing passwords, accounts and access keys where necessary.
Tencent Cloud, one of China's largest cloud service providers, advised customers to install updated PHP versions but did not recommend widespread website shutdowns.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures amid concerns about increased hacking attempts.
The incident has highlighted the growing influence of artificial intelligence on cybersecurity.
While AI-assisted analysis can help researchers identify previously undetected software vulnerabilities, similar technologies can also enable attackers to develop and execute exploits more rapidly.
Microsoft CEO Satya Nadella said the crisis demonstrated the importance of building digital systems that can be securely maintained and updated.
The scale of the disruption also shows how vulnerabilities in a single widely used programming language can affect services across multiple industries and countries.
Cybersecurity specialists recommend that organisations running PHP-based applications update to the latest patched versions, review their systems for signs of exploitation and strengthen security monitoring.
Businesses may also need to assess potentially exposed credentials and carefully test affected applications before restoring suspended services.
For companies that depend heavily on digital platforms, the incident serves as a reminder that delayed security updates can threaten not only business continuity but also customer access to essential services.
