Companies and governments around the world raced on Thursday to patch critical vulnerabilities in the widely used PHP programming language, as millions of hacking attempts were reported and authorities across Asia activated emergency cybersecurity measures.

The rush came after government websites in Europe and elsewhere went offline on Wednesday, with the disclosure of the flaws sending website operators scrambling to protect their systems.

PHP developers released urgent security fixes on Wednesday after vulnerabilities that had remained in the software for years were uncovered using artificial intelligence. The developers urged all users to update immediately.

Cloudflare Chief Executive Matthew Prince said attempts to exploit the vulnerabilities had surged dramatically following their public disclosure.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Prince said in a post on social media platform X late on Wednesday.

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

The vulnerabilities could allow attackers to execute malicious commands without authentication, steal sensitive information or take websites offline, according to South Korea’s science ministry.

Asian governments activate emergency measures

South Korea raised its private-sector cybersecurity alert level on Thursday and activated emergency response measures, citing the increased risk of hacking attacks.

The presidential National Security Office convened an emergency meeting involving intelligence, defence and science ministry officials to coordinate responses across the public, private and military sectors.

The science ministry said it had issued security guidance to approximately 28,000 companies with registered chief information security officers and 5,900 members of a government information-sharing network.

Operators of critical infrastructure, web-hosting companies and data centres were also alerted.

Authorities urged organisations to install the latest PHP security updates and introduce temporary safeguards where immediate patching was not possible.

China’s industry ministry similarly called on organisations and users to inspect their systems immediately and upgrade to the latest secure version of PHP.

It also recommended strengthening cybersecurity monitoring and promptly changing accounts, passwords and security keys.

Japanese banks and government services affected

In Japan, Mitsubishi UFJ Financial Group said on Thursday it was temporarily suspending some internet services as part of emergency security measures.

Japan’s Finance Ministry also suspended some website content and online services while implementing protective measures.

Prime Minister Sanae Takaichi urged website operators on Wednesday to check whether their systems used PHP and prepare to install the security fixes.

The disruptions and emergency measures highlight the potential impact of vulnerabilities in PHP, a programming language widely used to power websites and online services.

The disclosure of the flaws, followed by the rapid escalation in attempted exploitation, has prompted governments and businesses to accelerate security updates to protect their systems from possible attacks.

The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.

PHP is used across large parts of the internet, and speculation has circulated over the past day that websites running the software could be exposed to serious cyber intrusions.

“PHP is everywhere. It quietly powers WordPress, Drupal, Joomla, and Magento sites, shared hosting platforms, control panels, and an awful lot of software that doesn’t even advertise that it runs PHP under the hood,” cybersecurity company Huntress said in a blog post.

In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to “upgrade as soon as the release is available”.

It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday.

Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare NET.N, said that attacks were emerging and Cloudflare was updating its firewall rules as a stopgap measure.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he said on X.

The European Union Computer Emergency Response Team (CERT-EU) said on Tuesday in an advisory that the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that can allow attackers to run malicious code on vulnerable systems without logging in.

CERT-EU urged organisations to prepare for the immediate patching of affected assets and said those unable to do so should consider taking affected sites offline.

The Australian Cyber Security Centre (ACSC) issued similar guidance, urging organisations to identify PHP systems in their environments, prepare to apply patches and monitor applications for signs of malicious activity.

“ACSC is currently not aware of active exploitation related to these vulnerabilities,” the agency said.

Web hosting provider GoDaddy said the flaws could allow attackers to execute code on affected servers over the internet, potentially leading to data theft, website defacement or full system compromise.

Wordfence, a security plugin that protects WordPress websites, said all WordPress sites run on a PHP-installed server. It warned that automatic updates would not apply the fix and advised site owners to find out who is responsible for updating PHP on their sites.

PHP’s security team said details of the vulnerabilities, affected versions and the fixed releases would be published when patches are issued.

CERT-EU and the ACSC said all PHP versions from PHP 5 onward could be affected, although PHP has not disclosed which versions are vulnerable.

One of the largest medical data breaches in Poland’s history has potentially exposed the records of nearly 19 million citizens. The data was exposed through MyDr, a private provider of software used by clinics and doctors across the country. The haul: around 2.5 terabytes of data. Not passwords or logins. Prescriptions. Medical histories. Diagnoses. PESEL […]