Asian governments step up cyber defences after PHP flaw

Companies and governments around the world raced on Thursday to patch vulnerabilities in the widely used PHP programming language, as experts reported a surge in hacking attempts following their disclosure.

The rush came after government websites in Europe and elsewhere went offline on Wednesday, with the disclosure of the flaws sending website operators scrambling to protect their systems.

PHP developers on Wednesday released urgent new fixes to vulnerabilities that had lurked in the software for years until they were uncovered using AI, saying all users were "encouraged to update immediately."

"In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it," Matthew Prince, the CEO of cloud services firm Cloudflare, said in a post on social media platform X late on Wednesday.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."

Japanese lender Mitsubishi UFJ Financial Group said on Thursday it was temporarily suspending some internet services due to emergency measures. Japan's Finance Ministry also suspended some website content and online services while implementing security measures.

Several governments across Asia ordered cybersecurity inspections related to the PHP flaw on Thursday.

China's industry ministry urged organisations and users to immediately inspect their systems and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and promptly changing accounts, passwords and keys.

South Korea's government raised its private-sector cybersecurity alert level and activated emergency response measures over the flaw, citing concerns about an increased risk of hacking attacks.