Companies and govts step up cyber defences after PHP flaw

Updated / Thursday, 22 Oct 2026 10:54

Getty

Companies and governments around the world are racing to patch vulnerabilities in the widely used PHP programming language, as experts reported a surge in hacking attempts following their disclosure.

The rush came after government websites in Europe and elsewhere went offline yesterday, with the disclosure of the flaws sending website operators scrambling to protect their systems.

PHP developers released urgent new fixes to vulnerabilities that had lurked in the software for years until they were uncovered using AI, saying all users were "encouraged to update immediately".

"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," Matthew Prince, the CEO of cloud services firm Cloudflare, said in a post on social media platform X last night.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he added.

PHP is used by almost 70% of websites, according to cybersecurity firm Cloudflare, and underpins popular platforms such as WordPress and Magento.

---

Watch: Cybersecurity expert says hackers could potentially steal data over software issue

---

The Finnish government's website was one of several to be partly disabled because of the incident, along with the websites of several local authorities in the UK.

Oxford City Council and the City of Edinburgh Council were among the organisations to take their websites offline, while pages for some BBC programmes were unavailable.

Japanese lender Mitsubishi UFJ Financial Group said it was temporarily suspending some internet services due to emergency measures.

Japan's Finance Ministry also suspended some website content and online services while implementing security measures.

Several governments across Asia ordered cybersecurity inspections related to the PHP flaw on Thursday.

China's industry ministry urged organisations and users to immediately inspect their systems and upgrade to the latest secure version of PHP.

It also recommended strengthening cybersecurity monitoring and promptly changing accounts, passwords and keys.

South Korea's government raised its private-sector cybersecurity alert level and activated emergency response measures over the flaw, citing concerns about an increased risk of hacking attacks.