Governments and companies across several continents took websites offline this week as they rushed to patch critical PHP flaws in a programming language that runs behind much of the internet. The PHP developers released fixes on Wednesday and urged users to update immediately. Cloudflare, a cloud services firm, said hacking attempts had surged into the millions, while officials in several countries said they had seen no confirmed breaches so far.
Shutdowns spread from Tokyo to Helsinki
Japanese companies including the brokerage Nomura, the lender Mitsubishi UFJ Financial Group, the airline ANA and East Japan Railway said on Thursday that they were temporarily suspending some internet services as an emergency measure. In Finland, the state IT services provider Valtori shut down government public web services a day earlier and said on Thursday that it was gradually lifting the blocks while it installed patches. In the United Kingdom, the tech minister, Baroness Lloyd of Effra, told the House of Lords that 32 government services were unavailable and four were partly unavailable, a result she linked to precautionary steps.
In France, local government websites, including the Paris Police Prefecture, had been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency. The telecoms group Orange also suspended access to some PHP-based sites across several subsidiaries. In the Netherlands, the national digital identity service DigiD went offline as a precaution, and China's industry ministry urged organisations to inspect their systems and upgrade, while South Korea raised its private-sector cyber-security alert level.
What the flaws are and what is known about attacks
PHP runs on web servers, where it turns stored data into the pages visitors read, and it sits beneath many popular website platforms. The US National Security Agency said the flaws “often provide a direct path” to a server's files or database, and attackers could use them to take over web servers without a password. The flaws were reported privately in August by the security firm Calif and by OpenAI, and details leaked online on Tuesday, a day before the planned release.
Cloudflare chief executive Matthew Prince wrote on X that the company saw thousands of attempts to exploit the flaw in the 10 hours before the public announcement, a figure that rose to tens of thousands within 45 minutes and then to millions. Wiz, a cyber-security firm, said PHP powers about 70% of the world's websites and that the flaws affected many past versions of the language. The UK's National Cyber Security Centre said it had seen no indications of successful breaches, though its chief technology officer, Olly Whitehouse, called the event unprecedented.
Felix Kuhlenkamp, head of security at the German industry body Bitkom, said many larger operators had already updated, but complex systems and smaller organisations could take longer. Valtori said restoring services could take days or even weeks, since systems must be carefully tested after updates. Microsoft chief executive Satya Nadella said he had not seen anything like this in a long time.
Timeline: what has happened so far
- August: Calif and OpenAI each reported the PHP flaws privately to the language's developers, who kept them confidential while a fix was prepared.
- Tuesday: Details of the flaws leaked online, a day before the planned release.
- Wednesday: The PHP developers released fixes, and governments in France, the Netherlands, Belgium and Finland took sites offline as a precaution.
- Late Wednesday: Cloudflare's chief executive posted that exploit attempts had jumped from thousands to millions.
- Thursday: Japanese firms suspended some services, South Korea raised its alert level, and Valtori began gradually restoring blocked services.
Aasan alfaaz mein
PHP aik programming language hai jo bohat si websites ke peechay kaam karti hai, aur is mein kuch kamzoriyan mili hain. Is ki wajah se kai hukumaton aur companies ne ehtiyati tor par apni websites band kar di hain. Abhi tak koi kamyab hacking confirm nahi hui, lekin hacking ki koshishen bohat tezi se barh gayi hain. Agar aap kisi website ya online service ko istemal karte hain, to kuch din ki rukawat ho sakti hai, is liye update hone ke baad hi us par details dein.
