The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand.
Tokyo/Beijing/Amsterdam: Global firms and governments rushed on Thursday to patch critical flaws in the PHP programming language that underpins much of the internet, as cloud firms reported a surge of hacking attempts after the vulnerabilities were disclosed.
The push came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.
The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand.
“I’ve not seen anything like this in a long, long time,” Microsoft CEO Satya Nadella said at an event in Germany on Thursday, saying the incident showed the importance of building software that can be maintained securely as systems grow more complex.
“It was a long day and a long night, I know, for all the IT and security folks.”
PHP key to internet’s foundation like HTML, PYTHON
The developers of PHP – a computing language like HTML and Python – released fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI. They urged users to “update immediately”.
Madeline Lawrence, co-founder of Belgian cybersecurity firm Aikido Security, said that details of the flaws had become public before fixes were ready, with attacks reported since.
“Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race,” she said.
As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare and Amazon
“In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said in a post on X late on Wednesday.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.” Amazon also said it saw widespread exploitation.
Impact from Japan to Finland
Japan said on Friday it will set up a team to simulate cyberattacks using AI to identify weaknesses in technology systems as organizations scramble to curtail risks from flaws in the PHP programming language that underpins much of the internet.
Highlighting the extent of the disruption, Japan’s third-largest mobile carrier, SoftBank, said on Friday it was suspending its emergency alert system for mobile users.
That means customers will not receive early warnings for earthquakes, tsunami alerts or disaster and evacuation information as the system undergoes maintenance to address a PHP vulnerability, SoftBank said.
Japan is regularly affected by natural disasters and is one of the world’s most earthquake-prone countries, with typhoon Champi currently approaching the southernmost prefecture of Okinawa.
SoftBank, which has more than 30 million smartphone customers, said users can still receive earthquake warnings through services such as an app from its Yahoo business.
“An attack can succeed by getting through just one hole … for that reason it’s important we shift our mindset and think from the perspective of the attacker,” Japanese industry minister Ryosei Akazawa said on Friday.
“Defenders also need to make use of AI and respond proactively, staying one step ahead.”
Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, said the government response was too slow.
“This is like trying to take on a bomber with a bamboo spear,” he said.
Emergency shutdowns this week from Tokyo to Helsinki of banking, airline, rail, tax and government services marked one of the most dramatic tests of the decades-old programming tools that keep the web running.
Companies including brokerage Nomura, lender Mitsubishi UFJ Financial Group, airline and East Japan Railway temporarily suspended some internet services as part of emergency measures.
Japan’s Ministry of Finance, National Tax Agency and Meteorological Agency also suspended some online services.
On Friday, JR East said some group services had resumed while others would be restored once confirmed safe. Nippon Paint said it had applied a security patch as a precaution and its website is back online.
Attackers are likely targeting Japanese businesses for their thorough records, which are no longer protected by a language barrier because of AI, said Eva Chen, CEO of Trend Micro.
Japan has been too comfortable with its existing infrastructure, which it felt was safe enough, she said.
Cybersecurity experts have said AI is helping attackers automate tasks from scanning for software vulnerabilities to crafting phishing campaigns, making cybercrime faster, cheaper and harder to detect.
The developers of PHP released fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI. They urged users to “update immediately.”
Japanese companies including brokerage Nomura lender Mitsubishi UFJ Financial Group airline ANA and East Japan Railway said on Thursday they were temporarily suspending some internet services as part of emergency measures.
Brewer Asahi Group Holdings temporarily suspended certain websites and systems and was conducting a security impact assessment. Insurer Tokio Marine Holdings said it had suspended its group website.
Japan’s Ministry of Finance and Meteorological Agency partially suspended online services to implement safety measures, while Japan’s National Tax Agency temporarily took down its service.
The precautionary shutdowns show Japan’s growing concerns over cybersecurity, as the country recorded more cyber incidents in the first nine months of the year than in all of last year, according to data from TrendAI.
French telecoms group Orange said it had temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution.
Tencent Cloud, one of China’s largest cloud-computing providers, urged customers to install updated PHP versions but stopped short of calling for widespread website shutdowns.
Finland’s state IT services provider Valtori said it had continued installing PHP security patches overnight and was gradually lifting precautionary service blocks after shutting down government public web services a day earlier.
“Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Valtori Director General Hannu Naumanen said in a statement.
Valtori said the outages were not caused by exploitation of the vulnerabilities or by a cyber breach, and that it was not aware of any active exploitation of the flaws.
Some fixes may take weeks to implement
Several Asian governments ordered cybersecurity inspections related to the PHP vulnerabilities on Thursday.
China’s industry ministry urged organizations and users to inspect systems and upgrade to the latest secure version of PHP. It also recommended strengthening cybersecurity monitoring and changing accounts, passwords and keys where necessary.
South Korea raised its private-sector cybersecurity alert level and activated emergency response measures, citing concerns over an increased risk of hacking attacks.
Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said that many larger operators had already carried out updates, but that for complex IT systems and smaller organizations it could take longer.
“They may run a website using PHP but don’t really keep a close eye on it,” he said. “If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.”
Reuters