Critical PHP vulnerabilities trigger global cybersecurity emergency

2026, October 22

Worldwide / Japan / Finland / France / China

Governments and companies worldwide are urgently patching critical vulnerabilities in PHP, a programming language used extensively to power websites and online services. The flaws were uncovered using AI, and their disclosure prompted emergency security measures, including temporary shutdowns of some government, banking, airline, railway and tax websites. Cloudflare reported that attempts to exploit the vulnerabilities escalated from thousands to millions following public disclosure.

The incident has affected organisations across several countries. Japanese financial institutions and transport operators suspended certain online services, while Finnish authorities worked to restore government websites after precautionary shutdowns. Security experts warn that older systems may take longer to update, particularly where organisations rely on outdated PHP versions that no longer receive security patches.

Why it matters: The incident demonstrates how a vulnerability in widely used software can threaten essential services across national borders. It also highlights a growing cybersecurity challenge: AI can help researchers discover flaws, but attackers may also use AI to exploit them rapidly.

Source: Reuters — Millions of hacking attempts as companies and governments rush to patch PHP flaws