TOKYO/BEIJING/AMSTERDAM, October 22 (Reuters) – Global companies and governments raced on Thursday to fix critical flaws in the PHP programming language, which underpins a large part of the internet, after a cloud computing company reported millions of intrusion attempts following disclosure of the vulnerabilities.
The action occurred after governments in Europe and elsewhere took sites offline as a precaution on Wednesday, while site operators hurried to protect systems running the software.
Emergency outages in banking, aviation, rail, tax and government services, from Tokyo to Helsinki, mark one of the most dramatic tests of programming tools that have existed for decades to keep the web running, exposing how much governments and companies depend on code that few people understand.
“I haven’t seen anything like this in a very long time,” said Microsoft chief executive Satya Nadella at an event in Germany on Thursday, stating that the incident highlighted the importance of developing software that can be securely maintained as systems become more complex.
“It was a long day and a long night, I know, for the IT and security teams.”
PHP IS FUNDAMENTAL TO THE INTERNET
PHP developers — a programming language as fundamental as HTML and Python — released fixes on Wednesday for vulnerabilities that had been lurking in the software for years until discovered through AI, urging users to “update immediately.”
Madeline Lawrence, cofounder of Belgian cybersecurity company Aikido Security, said that the details of the flaws had become public before fixes were ready, with attacks having been reported since then.
“Companies are racing to update against intruders who may use AI to exploit them. That is the whole race,” she said.
As companies and governments rolled out patches and suspended sites as a precaution, hacking attempts reached into the millions, according to the cloud services company Cloudflare.
“In the 10 hours before the public announcement, we observed thousands of exploitation attempts across the network,” said Cloudflare’s CEO, Matthew Prince, in a post on X on Wednesday night.
“That number jumped to tens of thousands in the 45 minutes after the announcement, hundreds of thousands in two hours and, now, millions.”
IMPACT ACROSS JAPAN TO FINLAND
Japanese companies, including Nomura Securities, the Mitsubishi UFJ Financial Group, the ANA airline and East Japan Railway, said on Thursday they were temporarily suspending some internet services as part of emergency measures.
The Asahi Group Holdings brewery temporarily suspended certain sites and systems and was conducting a security impact assessment. Tokio Marine Holdings said it had suspended the group’s website.
The Ministry of Finance and the Japan Meteorological Agency partially suspended online services to implement security measures, while the Japan National Tax Agency temporarily took its service offline.
These precautionary suspensions underscore Japan’s growing cybersecurity concerns, as the country recorded more cyber incidents in the first nine months of the year than in all of last year, according to TrendAI data.
The French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications at several subsidiaries as a precaution.
Tencent Cloud, one of China’s largest cloud computing providers, urged customers to install updated PHP versions but did not call for a widespread shutdown of sites.
Valtori, Finland’s state IT services provider, said it continued installing PHP security patches overnight and was gradually lifting preventive service blocks after disabling the government online services the day before.
“Restoring services may take days or even weeks, as, in addition to updates, systems must be carefully tested,” said Valtori’s managing director Hannu Naumanen in a statement.
Valtori added that the outages were not caused by exploitation of the vulnerabilities nor by a cyber breach, and that it had no knowledge of any active exploitation of the flaws.
PATCHES MAY TAKE WEEKS
Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
China’s Ministry of Industry urged organizations and users to inspect their systems and update to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.
South Korea raised its cybersecurity alert level for the private sector and activated emergency response measures, citing concerns about the rising risk of hacker attacks.
Felix Kuhlenkamp, head of security at Germany’s digital industry association Bitkom, said that many large operators had already carried out the updates, but that for complex IT systems and smaller organizations the process could take longer.
“They may have a site that uses PHP but do not monitor it closely,” he said. “If a site is based on an older version of PHP for which there is no security update, the entire system must be updated.”
