Emergency shutdowns from Tokyo to Helsinki show how much of the web depends on a language few people think about, and some fixes could take weeks.
Companies and governments are racing to patch two critical vulnerabilities in PHP, as cloud providers report millions of hacking attempts since the flaws were disclosed, according to Reuters.
Cloudflare CEO Matthew Prince said attempts climbed from thousands in the ten hours before the announcement to millions within hours of it, Reuters reports. Amazon also said it had seen widespread exploitation.
The flaws, CVE-2026-109618 and CVE-2026-109619, could allow remote code execution, and any PHP installation serving web requests is considered at risk. Both are rated 9.2 out of 10, and fixes arrived on Wednesday in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official updates.
PHP runs nearly 70% of websites with an identifiable server-side language.
Microsoft CEO Satya Nadella, speaking at an event in Germany, said he had “not seen anything like this in a long, long time,” Reuters reports.
Shutdowns Stretch From Japan to Finland
Several Japanese firms, including Nomura, Mitsubishi UFJ Financial Group, ANA and East Japan Railway, temporarily suspended some online services, Reuters reports. Japan’s Ministry of Finance and Meteorological Agency partially suspended services, and the National Tax Agency took its service down.
France’s Orange suspended access to some PHP-based sites across several subsidiaries. Tencent Cloud urged customers to update but stopped short of calling for shutdowns.
Finland’s state IT provider Valtori is gradually lifting the blocks it placed on public government services. Director General Hannu Naumanen said restoring services can take days or even weeks because systems need testing after updates. Valtori said the outages were precautionary and it was not aware of active exploitation.
China’s industry ministry urged organisations to inspect their systems, and South Korea raised its private-sector cybersecurity alert level. In the US, the NSA urged organisations to take websites offline if they could not fix the flaws immediately.
EM360Tech also took our own website offline as a precaution while our team assessed the risk, as covered in our explainer on the vulnerabilities.
Rethinking Patch Risk Windows
The Liquid exploit reveals how the gap between code changes and deployed patches becomes a critical risk as AI speeds exploit creation.
AI Found the Flaws and Details Leaked Early
The vulnerabilities had gone unnoticed for years before AI tools uncovered them. OpenAI said they were found through its programme giving cybersecurity firms access to its models.
The PHP Foundation said Chainguard shared details of the patch about six hours before release, breaking an embargo agreement. The Foundation said this made it easier for attackers to reverse engineer the fix.
Madeline Lawrence, co-founder of Aikido Security, told Reuters that details became public before fixes were ready. She described the situation as a race between defenders and attackers using AI to exploit the flaws.
Smaller Operators Face the Longest Wait
Bitkom security head Felix Kuhlenkamp told Reuters that many larger operators have already updated. Complex IT systems and smaller organisations will take longer, he said, particularly those that run PHP sites without monitoring them closely.
Sites running old PHP versions with no security update need the whole system upgraded, Kuhlenkamp added. For platforms like WordPress, updating content or plugins alone will not fix the flaws, because the problem sits in PHP itself.
Comments ( 0 )