Millions of Hacking Attempts Hit Websites After Critical PHP Flaws Made Public

Cloudflare says hacking attempts have surged into the millions since two critical vulnerabilities in PHP were made public. PHP is a programming language used by more than two-thirds of websites. The flaws had reportedly sat in the software for years before being uncovered using AI. Cloudflare chief executive Matthew Prince said the company saw thousands of attempts to exploit one of the issues in the 10 hours before it was publicly announced.

The Australian Signals Directorate and other agencies worldwide have urged websites to patch urgently. PHP's developers released fixes and told users to "update immediately". Some governments took sites offline as a precaution, with emergency shutdowns affecting banking, airline, rail, tax and government services from Tokyo to Helsinki. Microsoft chief executive Satya Nadella said he had not seen anything like it in a long time, and stressed the need to build software that can be maintained securely as systems grow more complex.

Several Asian governments ordered cybersecurity inspections. China's industry ministry urged organisations to inspect their systems, upgrade to the latest secure PHP version, strengthen security monitoring, and change accounts, passwords and keys where necessary.