Companies and governments around the world rushed Thursday to fix critical flaws in the widely used PHP programming language, as a cybersecurity company reported millions of attack attempts following the disclosure of the vulnerabilities.
The move came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday, while those responsible for the websites worked to protect the systems that use the software.
The emergency shutdowns of banking, airline, rail, tax and government services, from Tokyo to Helsinki, showed the extent to which public and business systems depend on this software, and how difficult it is to quickly fix these flaws once they become public.
“It's been a long day and a long night, I know, for all the IT and security teams... I haven't seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at a company event in Cologne, Germany, on Thursday. As he explained, the episode highlights the importance of building digital systems that can be maintained securely.
PHP developers on Wednesday released urgent fixes for vulnerabilities that had been in the software for years until they were discovered with the help of artificial intelligence, and urged users to “update immediately.”
“The details of these flaws were made public before the fixes were ready, and attacks have been reported since then,” said Madeline Lawrence, co-founder of Belgian cybersecurity company Aikido Security. "So companies are racing to upgrade in the face of attackers who can use AI to exploit them. That's the whole race."
As companies and governments patched and suspended websites as a precaution, attack attempts soared into the millions, according to cloud services company Cloudflare.
“In the 10 hours leading up to its public announcement, we saw thousands of attempts to exploit it across our network,” Cloudflare CEO Matthew Prince said in a post on X late Wednesday. “That jumped to tens of thousands within 45 minutes of the announcement, to hundreds of thousands within two hours and to millions now.”
From Japan to Finland
Japanese companies including brokerage Nomura, financial institution Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as part of emergency measures. Insurance company Tokio Marine Holdings said it had suspended the website of a group company.
The Ministry of Finance and the Japanese Meteorological Agency partially suspended online services to implement security measures, and the Japanese National Revenue Agency temporarily withdrew its service.
The preventive closures underscore growing concerns about cybersecurity in Japan, which recorded more cyber incidents in the first nine months of the year than in the entire previous year, according to data from TrendAI.
French telecommunications group Orange said it had temporarily suspended access to certain PHP-based websites and applications at several of its subsidiaries as a precaution.
Tencent Cloud, one of China's largest cloud computing providers, urged its customers to install updated versions of PHP, but stopped short of calling for widespread website shutdowns.
Finland's state IT services provider, Valtori, said it had continued to install PHP security patches overnight and was gradually lifting preventive blocks after shutting down government public web services a day earlier.
“Restoring services can take days or even weeks, as in addition to updates, systems must be carefully tested,” Valtori CEO Hannu Naumanen said in a statement.
Valtori said the outages were not due to exploitation of the vulnerabilities or a cyber breach, and that he was not aware of any active exploitation of the flaws.
Several Asian governments on Thursday ordered cybersecurity inspections related to PHP vulnerabilities.
China's Ministry of Industry urged organizations and users to immediately review their systems and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity surveillance and changing accounts, passwords and keys when necessary.
South Korea raised the private sector's cybersecurity alert level and activated emergency response measures, citing concerns about an increased risk of cyberattacks.
