Hacking attempts surge as websites race to patch PHP issues

In short:

Cloud services firm Cloudflare says hacking attempts surged in the hours after two vulnerabilities with PHP were made public.

PHP is a programming language used widely across the internet.

What's next?

Global agencies, including the Australian Signals Directorate, are urging websites to urgently patch their code.

Millions of hacking attempts have been made since critical vulnerabilities were discovered in a key piece of internet software used by more than two-thirds of websites.

Governments and major websites have rushed to patch two critical issues with PHP, a widely used computing language, after they were reportedly discovered by AI.

Australia's own cyber security agency, the Australian Signals Directorate, is among agencies around the world to issue urgent warnings for websites to implement a new patch.

In some instances, governments have taken websites offline as a precautionary measure.

The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand.

Cloud services firm Cloudfare said since the two vulnerabilities were made public, hacking attempts had surged into the millions.

"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," Cloudflare chief executive Matthew Prince said in a post on X late on Wednesday, US time.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."

The developers of PHP released fixes for vulnerabilities that had lurked in the software for years until they were uncovered using AI, urging users to "update immediately".

"I've not seen anything like this in a long, long time," Microsoft chief executive Satya Nadella said at an event in Germany on Thursday, local time.

He said the incident showed the importance of building software that can be maintained securely as systems grow more complex.

"It was a long day and a long night, I know, for all the IT and security folks."

Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities.

China's industry ministry urged organisations and users to inspect systems and upgrade to the latest secure version of PHP. 

It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.

South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns over an increased risk of hacking attacks.