PHP Security Flaws 2026: Millions of Hacking Attempts Target Vulnerable Systems
PHP security flaws triggered millions of reported exploit attempts, prompting companies and governments in Japan, Europe, China and South Korea to patch systems and restrict online services.
Raja Awais Ali
10/22/20265 min read
PHP Security Flaws Trigger Millions of Hacking Attempts as Companies and Governments Rush to Patch Systems
Companies and governments around the world are racing to fix two critical security vulnerabilities in PHP, a widely used programming language for websites and online services. On October 22, cybersecurity firm Cloudflare reported a sharp increase in attempts to exploit the flaws after details became public, with activity rising from thousands of attempts to millions.
The vulnerabilities prompted precautionary shutdowns and restrictions on online services in several countries as organisations worked to secure their systems. Affected services included government websites, financial services, airline platforms and railway systems. However, precautionary shutdowns do not necessarily mean that the affected organisations had been successfully hacked.
PHP is commonly used to process requests on web servers, including user logins, submitted forms and other website functions. A vulnerability in this software can create an opportunity for attackers to interfere with a system, depending on the nature of the flaw and how the server is configured.
The two vulnerabilities had reportedly remained in the software for years before being identified with the help of artificial intelligence (AI). PHP developers released security updates on Wednesday, October 21, and urged users to install them immediately.
The incident highlights the risks that arise when details of a software vulnerability become public before all organisations have secured their systems. Attackers can use publicly available technical information to identify potentially vulnerable servers and attempt to exploit them before administrators complete the necessary updates.
An exploit attempt involves trying to trigger a software vulnerability through a specially crafted request or another technique. Depending on the flaw, a successful attack could disrupt a website, enable unauthorised access or expose information. The specific technical mechanisms of the two PHP vulnerabilities and the extent of any resulting data theft were not established in the supplied report.
Cloudflare Reports Millions of Exploit Attempts
Cloudflare Chief Executive Matthew Prince described a rapid increase in activity following the public disclosure of the vulnerabilities.
In a post on X late Wednesday, Prince said Cloudflare had recorded thousands of attempts across its network during the 10 hours before the issue was publicly announced. The figure rose to tens of thousands within the first 45 minutes after the announcement, reached hundreds of thousands within two hours and subsequently climbed into the millions.
The figures refer to attempts to exploit the vulnerabilities, not millions of confirmed successful attacks. Nevertheless, the increase illustrates how quickly attackers can respond when information about a security weakness becomes publicly available.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said details of the flaws had become public before fixes were ready, and attacks had subsequently been reported. She said organisations were racing to update their systems while attackers could use AI to help exploit vulnerable software.
AI can assist with analysing code, identifying weaknesses and developing or adapting attack techniques. However, its involvement does not automatically mean an attack will succeed. The outcome depends on the vulnerability, the target system and the security measures already in place.
Japanese Companies Suspend Some Online Services
Several major Japanese companies announced temporary suspensions of internet services on Thursday as part of precautionary security measures.
They included brokerage Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway. The companies said they were temporarily suspending some online services while addressing the potential risks.
Insurer Tokio Marine Holdings also suspended the website of one of its group companies.
Japan's Ministry of Finance and Meteorological Agency partially suspended online services, while the National Tax Agency temporarily took its service offline.
These measures demonstrated the potential impact of vulnerabilities in widely used software. When online platforms support essential financial, transport and government services, organisations may restrict access while checking systems and applying security updates.
Japan was already facing increased cybersecurity concerns. According to data from TrendAI cited in the report, the country recorded more cyber incidents during the first nine months of 2026 than throughout the whole of 2025.
European Organisations Work to Restore Services
Government websites across parts of Europe went offline on Wednesday as operators responded to the PHP vulnerabilities.
French telecommunications group Orange temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.
Finland's state IT services provider, Valtori, said it continued installing security patches overnight after shutting down public government web services a day earlier. The organisation was gradually lifting precautionary restrictions as security measures progressed.
Valtori Director General Hannu Naumanen said restoring services could take days or even weeks because systems needed to be carefully tested after updates were installed.
The organisation also clarified that its service disruptions had not been caused by exploitation of the vulnerabilities or a cyber breach. It said it was not aware of active exploitation of the flaws.
The distinction is important because taking a website offline can be a preventive measure rather than evidence that an attack has succeeded. Organisations may choose to restrict access until they are confident that their systems are adequately protected.
China and South Korea Strengthen Cybersecurity Measures
Chinese authorities urged organisations and users to inspect their systems immediately and upgrade to the latest secure version of PHP.
China's industry ministry also recommended strengthening cybersecurity monitoring and changing accounts, passwords and security keys where necessary.
Tencent Cloud, one of China's major cloud-computing providers, advised customers to install updated PHP versions. However, it did not call for widespread website shutdowns.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures amid concerns about an increased risk of hacking attempts.
Several Asian governments also ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
Microsoft CEO Highlights the Challenge of Maintaining Secure Systems
Microsoft Chief Executive Satya Nadella addressed the incident at a company event in Cologne, Germany, on Thursday.
He described the experience as a long day and night for IT and security professionals and said he had not seen anything comparable in a long time.
Nadella said the episode highlighted the importance of building digital systems that can be maintained securely. Keeping software updated and ensuring that organisations can respond quickly to newly discovered vulnerabilities are essential parts of cybersecurity.
Why Applying Security Updates Can Take Time
Installing a patch is only one part of responding to a serious software vulnerability. Organisations first need to identify which servers and applications are running affected versions, apply the appropriate updates and test whether their systems continue to function correctly.
For banks, airlines, railway operators and government agencies, an update may affect services connected to other applications and databases. Administrators must therefore balance the need to address a security risk quickly with the need to prevent additional technical problems.
Organisations may temporarily restrict access while applying updates and checking their systems. They may also review server logs and other security records to determine whether attackers attempted to gain access before the patches were installed.
If there is evidence of unauthorised access, further action may be required, including changing passwords or security keys, investigating suspicious activity and checking whether sensitive information was exposed.
The PHP incident shows how a vulnerability in widely used software can affect organisations across different countries and industries. Because many online services rely on shared technologies, a weakness in one widely deployed component can create a common security challenge.
For now, the reported increase in exploit attempts has prompted organisations to prioritise security updates and system checks. The number of attempts alone does not establish how many attacks succeeded or whether data was stolen. Determining the actual impact requires evidence from affected systems and further investigation.
Stay informed with the latest national and international news.
© 2026. All rights reserved.