Companies and governments worldwide rushed on Thursday to patch critical flaws in the widely used PHP programming language, as a cybersecurity company reported millions of hacking attempts after the vulnerabilities were disclosed.

The push came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.

The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki showed how much public and corporate systems rely on the software, and how hard it is to fix such flaws quickly once they are made public.

“It was a long day and a long night, I know for all the IT and security folks … I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at a company event in Cologne, Germany, on Thursday.

He said the episode underscored the importance of building digital systems that can be maintained securely.

PHP developers released urgent fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI, urging users to “update immediately”.

“Details of these flaws became public before fixes were ready, and attacks have since been reported,” said Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security.

“So companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”

As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare NET.N.

“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late on Wednesday.

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

FROM JAPAN TO FINLAND

Japanese companies including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as part of emergency measures.

Insurer Tokio Marine Holdings 8766.T said it had suspended the website of a group company.

Japan’s Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures, while Japan’s National Tax Agency temporarily took down its service.

The precautionary shutdowns underscore growing concerns over cybersecurity in Japan, which recorded more cyber incidents in the first nine months of the year than in all of last year, according to data from TrendAI.

French telecoms group Orange ORAN.PA said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.

Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions but stopped short of calling for widespread website shutdowns.

Finland’s state IT services provider Valtori said it had continued installing PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public web services a day earlier.

“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said in a statement.

Valtori said the outages were not caused by exploitation of the vulnerabilities or by a cyber breach, and that it was not aware of any active exploitation of the flaws.

Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.

China’s industry ministry urged organizations and users to inspect systems immediately and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.

South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns over an increased risk of hacking attacks.

Elon Musk’s public endorsement this week of a potential $3.5 trillion merger between SpaceX SPCX.O and Tesla TSLA.O has rattled some insiders involved in the discussions, who worry his comments could invite shareholder scrutiny and delay the process by several weeks, according to a person with direct knowledge of the talks.

The disclosure created a “mess” for the process, as it could lead to questions about how well Tesla shareholders’ interests would be represented, the person said. The concerns reflect similarities some participants see with Tesla’s 2016 acquisition of SolarCity, which sparked years of litigation over Musk’s role in the deal.

Musk, who serves as CEO of both SpaceX and Tesla and owns significant stakes in each company, this week told investors that the two companies were examining what would be the largest corporate transaction in history and revealed that both had formed special committees to evaluate it. The backlash to those remarks is reported here for the first time.

The parties have hired advisers, but discussions are at an early stage, three sources familiar with the matter said. SpaceX approached Tesla in recent weeks, and the companies have been discussing a range of transaction structures, including a SpaceX acquisition of Tesla or a merger under a newly formed holding company, the person familiar with the matter said. They are weighing different forms of merger consideration, including an all-stock deal, the person said. These details of the talks have not been previously reported.

Tesla, SpaceX and Musk did not respond to requests for comment.

SolarCity deal raises legal concerns

In related-party transactions such as a SpaceX-Tesla merger, independent board members typically oversee the process to safeguard public shareholders’ interests.

That issue loomed large in Tesla’s 2016 acquisition of SolarCity, which triggered years of litigation after shareholders alleged the world’s richest man had influenced the process to bail out his investment in the struggling rooftop solar company. At the time, Musk owned roughly 22% of both Tesla and SolarCity, which was founded by his cousins.

Shareholders argued that Musk’s involvement and public support undermined the deal’s fairness. Central to the case were claims that despite his minority stake, Musk was a controlling shareholder of Tesla due to his ties to board members and domineering style.

The Delaware Supreme Court later noted that plaintiffs’ contention of the absence of an independent committee, together with “certain other facts concerning Musk’s involvement in and public support for the transaction,” warranted the finding of unfair dealing.

The courts ultimately upheld the acquisition as fair, though it took several years for the case to be resolved and Tesla directors settled allegations for $60 million.

Musk excluded from merger negotiations

Musk owns nearly a fifth of Tesla and just under half of SpaceX, and analysts have said a merger would give him control of the combined entity. On Tuesday’s call with investors, Musk acknowledged that as a conflicted party he cannot be part of the discussions of the special committees. Advisers are also in contact with his lawyers to ensure Musk is recused from the merger discussions, the source familiar with the talks said.

Eric Talley, a law professor at Columbia University, said a merger could benefit shareholders by eliminating the need for Musk to divide his time between the two companies. He added that any legal challenge may be harder to predict than the SolarCity case because Tesla is now incorporated in Texas rather than Delaware.

“The Texas thing is a wild card. No one knows how Texas deals with cases like this because Texas never dealt with cases like this,” Talley said, noting that Texas has sought to establish itself as a business-friendly alternative to Delaware, and Musk’s comments so far were not necessarily problematic.

Ultimately, he said, litigation risk would hinge on the terms of any transaction.

“Who’s going to get the better side of this deal? And that’s usually what gives rise to litigation,” Talley said.

Public comments could delay historic deal

People involved in the process worry Musk’s public endorsement of the merger and disclosure of talks could intensify investor scrutiny, as interested parties typically avoid expressing views publicly while independent directors evaluate a deal, the source said.

The SolarCity case could become a reference point for investors and courts assessing any future SpaceX-Tesla transaction if advisers fail to fully insulate the special committees from Musk’s influence, the source added.

A tie-up between Tesla and SpaceX would be the biggest deal in history, creating one of the world’s largest industrial and technology groups. It would surpass Musk’s acquisition earlier this year of his artificial intelligence company xAI by SpaceX, which ranks among the largest corporate transactions ever announced.

A deal of this size would also face scrutiny from global regulators, especially due to Tesla’s business in China and SpaceX’s work in US defense and AI.

The Cyprus Chamber of Commerce and Industry (Keve) announced on Wednesday that existing businesses can apply for funding of up to €100,000 per project under a new €1.5 million grant scheme aimed at accelerating the development and commercialisation of innovative cybersecurity products and services.

The programme was announced by the Office of the Commissioner of Communications’ Digital Security Authority (DSA), acting as Cyprus’ designated National Cybersecurity Coordination Centre (NCC-CY), in cooperation with the Research and Innovation Foundation (RIF).

The scheme aims to help existing enterprises rapidly develop and bring competitive cybersecurity solutions to market, with funding available for innovative software, hardware and educational material.

The educational component covers material designed for critical infrastructure operators, small and medium-sized enterprises (SMEs) and students.

The total budget stands at €1.5 million, with individual projects eligible for grants of up to €100,000.

The call for proposals was launched on October 9, with applications due by December 8, 2026.

The scheme is co-funded by the Republic of Cyprus and the European Union’s Digital Europe Programme under the European project N4CY2, titled “Advancing the NCC-CY – The Next Chapter of the National Cybersecurity Coordination Centre of Cyprus”.

Interested businesses can find details of the funding conditions and submit proposals through the RIF’s IRIS platform.

Applicants can locate the relevant funding call by visiting the platform’s calls for proposals section.

The NCC-CY and RIF will hold an online information webinar on October 26 to explain the scheme and provide further details to prospective applicants.

The session will run from noon to 1pm, with interested businesses able to register through the official webinar registration page.

Keve encouraged eligible enterprises to review the scheme’s provisions and consider applying for funding to support the development and market introduction of cybersecurity innovations.