Millions of hacking attempts hit the open web within hours of a PHP vulnerability disclosure, and governments from Tokyo to Helsinki pulled services offline rather than risk exposure. It’s the most dramatic test of the programming language that underpins most of the internet, and it isn’t over yet.
Cloudflare reported the surge in real time. “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” CEO Matthew Prince wrote on X late Wednesday. That jumped to tens of thousands within 45 minutes of announcement, hundreds of thousands inside two hours, and millions now. Amazon Web Services said it also saw widespread exploitation of the same PHP2Shell vector, and Belgian firm Aikido Security co-founder Madeline Lawrence noted that details had become public before fixes were ready. “Companies are racing to update against attackers who can use AI to exploit them,” she said. “That’s the whole race.”
This is not a routine patch cycle. The vulnerabilities had lurked in PHP for years until uncovered using AI, and the emergency shutdowns of banking, airline, rail, tax and government sites mark one of the worst months for web security in decades. October 2026 has already earned the label Black October from security analysts tracking the cascade of breaches, vulnerability disclosures, and state-level responses.
The Race Between Patch and Exploit
Microsoft CEO Satya Nadella didn’t mince words at a Germany event Thursday. “I’ve not seen anything like this in a long, long time,” he said, calling the incident proof that software must be maintainable securely as systems grow complex. He added that it was “a long day and a long night” for IT and security staff across the industry.
The PHP developers released fixes Wednesday and urged users to “update immediately.” It was too late for some. Japanese broker Nomura, lender Mitsubishi UFJ Financial Group, airline ANA, and East Japan Railway all suspended internet services. The Ministry of Finance and Meteorological Agency partially shut down online services, and Japan’s National Tax Agency temporarily took down its portal. Asahi Group Holdings, Tokio Marine Holdings, and insurer sites followed. It’s a sign that even large, well-funded institutions couldn’t patch fast enough when the exploit window opened before the fix arrived.
The scope widened when attackers found the flaw before patches did, leaving a window of hours rather than weeks. Security researchers tracking the incidents said the disclosure timing meant organizations could not verify their exposure first, because patches arrived only after exploit code was already circulating.
French telecom Orange suspended PHP-based sites across subsidiaries. Finland’s Valtori, the state IT provider, kept patches running overnight and said restoring services could take days or even weeks because systems need careful testing. “Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said.
The vulnerability itself works by letting attackers inject commands through a malformed request to a PHP-based application. Once inside, they can execute arbitrary code on the server and move laterally across a corporate network. Patching requires not just updating PHP but also auditing any custom code that touches user input, because even patched versions can be exposed through poorly written extensions.
Why Small Sites Are the Real Risk
Felix Kuhlenkamp at Germany’s Bitkom said larger operators had mostly finished updates, but smaller organizations face a harder path. “They may run a website using PHP but don’t really keep a close eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.” That reality hits hard in Indonesia and Southeast Asia, where many government portals and brokerages still rely on legacy stacks and don’t have 24-hour security operations.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures. China urged organizations to inspect systems, strengthen monitoring, and change passwords and keys. The global coordination is real, but it doesn’t erase the underlying weakness: a language that runs roughly 77% of the web’s server-side logic is only as safe as the smallest site using an outdated version.
The AI Factor Changes Everything
The flaws weren’t found by human auditors. They were uncovered using AI, which means future vulnerabilities may surface faster than any patch team can react. Cloudflare’s network, already massive, saw the jump from thousands to millions of attempts in under two hours, and Amazon confirmed it wasn’t isolated to one provider. The attacker toolkit is also sharpening; suspected North Korean scanning activity has been linked to continued PHP2Shell exploitation attempts on government infrastructure.
It’s not clear this will hold. The patches are out, the networks have rebooted, but the pattern is set: AI discovers flaws, attackers automate exploitation, and governments learn they must either shut down or bet on speed. For a region like Indonesia, where digital banking and government services are growing quickly but security budgets haven’t kept pace, the lesson is direct. You don’t need to be a global bank to be in the blast radius; you just need an old PHP version and no one watching overnight.
What’s Next for Defenders
The incident exposed how deeply governments and companies depend on code few people understand, as Reuters reported from Tokyo, Beijing, Amsterdam, and Washington. It also showed that precautionary shutdowns are now part of the playbook. Japan recorded more cyber incidents in the first nine months of 2026 than in all of 2025, according to TrendAI data cited by Reuters.
Restoration will take longer than the outage. Valtori warned it could be days or weeks for complex systems. The PHP team urged an immediate update, but the real fix isn’t just a version bump; it’s sustained monitoring, faster disclosure, and a willingness to take services offline before attackers do it for you. The October disclosures aren’t an anomaly. They are a preview.
For more coverage of digital threats across Asia, see desk coverage, and read related story for the technical breakdown. The Reuters report on the global surge is available at Reuters.