Global Security Scramble After Critical PHP Vulnerabilities Disclosed

Global firms and government agencies rushed to apply emergency security patches to the PHP programming language, as cloud service providers reported a sharp surge in hacking attempts following the public disclosure of critical vulnerabilities. The widespread software flaws have triggered precautionary service disruptions across multiple sectors, including banking, transportation, and public administration, from Tokyo to Helsinki.

The emergency response highlights a heavy reliance on foundational programming tools that underpin a significant portion of the internet. Security researchers discovered that memory-safety issues in core PHP could allow unauthenticated attackers to execute remote code or read sensitive process memory. The vulnerabilities affect nearly every PHP version released over the past decade, dating back to version 5.4.

Microsoft CEO Satya Nadella addressed the unfolding situation during an event in Germany, noting the extraordinary scale of the incident. "I’ve not seen anything like this in a long, long time," Nadella said, adding that the event emphasized the critical importance of building software that can be maintained securely as digital systems grow increasingly complex.

Cloud infrastructure providers registered millions of probing and exploitation attempts shortly after the details were made public. Matthew Prince, CEO of Cloudflare, noted that observation networks detected thousands of exploitation attempts in the hours leading up to the announcement, with numbers quickly escalating into the hundreds of thousands and millions shortly afterward. Major technology platforms, including Amazon and Tencent Cloud, also reported widespread exploitation activity.

In response to the heightened risk, various organizations and municipal bodies implemented precautionary measures. In Japan, financial institutions, including Nomura and Mitsubishi UFJ Financial Group, alongside carriers like ANA and East Japan Railway, temporarily suspended select internet services. Government bodies such as the Ministry of Finance and the National Tax Agency also took online portals offline temporarily to conduct safety assessments.

European state IT services and enterprise organizations likewise mobilized overnight teams to secure systems and verify patches. Finnish state provider Valtori noted that while services were gradually restored following extensive testing, restoring complex IT architectures can require days or weeks. Authorities in China, South Korea, and other regions similarly heightened their domestic cybersecurity alert levels, urging organizations to inspect systems and upgrade to secure versions immediately.