Attacks targeting a severe PHP security vulnerability in the widely used programming language began four days before official security patches were publicly released. As governments and corporations temporarily suspended online services to fend off potential hacks, attempts to exploit the flaw surged into the millions following its public disclosure. Experts warn that with the rapid advancement of artificial intelligence in vulnerability analysis and attack tool development, traditional security response speeds are no longer enough to prevent widespread damage.
CJ Moses, Chief Information Security Officer (CISO) and Vice President at Amazon, revealed in a security blog post on the 21st (local time) that attempts to exploit the PHP vulnerability were first detected on the 17thβfour days ahead of the official vulnerability disclosure and patch distribution. Typically, security researchers or firms discover vulnerabilities, notify developers privately, prepare fixes, and then coordinate public notices detailing risks and updates. This time, however, hackers took action even before any public warnings were issued.
The attacks were detected using honeypot systems deployed specifically to monitor malicious activity. Additional attempts, likely involving multiple hackers, were confirmed just hours before the official patch release. Moses noted that the team is still analyzing whether the observed attacks would have successfully compromised live, production servers.
Following the disclosure, exploitation attempts skyrocketed. Matthew Prince, CEO of cloud service and security firm Cloudflare, posted on X (formerly Twitter) on the 21st that thousands of attack attempts were recorded on their network during the 10 hours leading up to the official announcement. The numbers jumped to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and ultimately reached millions.
The fallout is massive because PHP powers a vast majority of websites worldwide. PHP is used to build server-side programs that handle user requests such as logins and post creations. According to W3Techs, a web technology survey firm, approximately 69% of websites with identifiable server-side programming languages use PHP.
The two recently discovered security flaws allow external actors to compromise servers without logging in, enabling them to steal data, alter website content, or crash services entirely. Researchers experimentally confirmed that such intrusions are indeed feasible under certain environments. Because the flaw affects PHP, which is universally shared across numerous platforms, the risk of widespread damage escalated rapidly. PHP developers released a hotfix on the 21st, strongly advising all site operators to install it immediately.
Countries around the globe saw a wave of service suspensions aimed at preventing breaches. In Japan, Nomura Securities, All Nippon Airways (ANA), and East Japan Railway (JR East) temporarily halted select internet services. Government bodies including the Ministry of Finance, the Japan Meteorological Agency, and the National Tax Agency shut down parts or all of their online services to enforce security measures.
France’s Orange telecom group blocked access to several PHP-based websites and applications across its subsidiaries. In Finland, state IT service provider Valtori preventively suspended government public web services before lifting restrictions sequentially as patches were applied. In South Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) raised the private sector cyber crisis alert level from ‘Interest’ to ‘Caution’ at 12 PM on the 22nd.
The challenge lies in the difficulty of deploying newly released patches instantly across every website. Operators must verify that updates do not conflict with existing systems and test for stable functionality. In the meantime, hackers can analyze public security notices or patch changes to target unpatched sites. Hannu Naumanen, head of Valtori, noted that rigorous post-update testing means service recovery can take anywhere from several days to weeks.
The delay in addressing these security flaws has also drawn sharp criticism. The PHP Foundation admitted in a statement on the 21st that early signs of one vulnerability had already been identified in 2024. At the time, however, they failed to trace a concrete path to actual exploitation, and every proposed fix introduced compatibility issues with legacy programs. Compounded by a shortage of developers and delayed decision-making, remediation efforts experienced repeated halts and restarts over several months. The foundation characterized this as a structural failure stemming from a lack of resources and flawed decision-making frameworks.
Another growing concern is that advancing technology is accelerating hacker capabilities. Moses explained that while skilled hackers historically built tools for others to use, leveraging AI significantly lowers the cost of developing custom attack vectors using just patch changes or security announcements. True to this trend, additional exploit codes appeared mere hours after the patch release. Experts emphasize that organizations must shift from traditional 7-day or 30-day maintenance cycles to implementing patches and risk mitigation measures on an hourly basis.
