Global governments and major corporations are racing to patch critical vulnerabilities in the PHP programming language following a surge in hacking attempts that has prompted several nations to take public services offline. According to reports from Reuters, the disclosure of these flaws has triggered millions of exploit attempts, with Cloudflare Inc. reporting that attempts jumped from thousands to hundreds of thousands within two hours of the announcement.

Global Service Disruptions

The vulnerabilities, which developers say were uncovered using artificial intelligence, have forced emergency measures across multiple continents. In Japan, major entities including Mitsubishi UFJ Financial Group, East Japan Railway Co., and Tokio Marine Holdings Inc. have suspended various internet services as a precaution. The Japanese Ministry of Finance and the National Tax Agency also took services offline to implement safety measures.

In Europe, the Finnish state IT services provider Valtori reported that it had been installing security patches overnight after shutting down government public web services. Similarly, the French telecommunications group Orange suspended access to certain PHP-based applications across several subsidiaries.

Microsoft Corp. CEO Satya Nadella commented on the scale of the incident during an event in Germany, stating he had not witnessed a situation of this magnitude in a long time.

The “Black October” Surge

The current crisis has led some cybersecurity professionals on social media platforms like Reddit to refer to the period as “Black October,” citing a concentrated volume of high-severity incidents. While some of these reports remain unverified by independent news agencies, the scale of the reported breaches is significant.

Key incidents reported include:

  • Infrastructure and Software: A vulnerability known as PHP2Shell, affecting software used by approximately 70% of websites, has prompted government shutdowns. Additionally, NGINX, which powers roughly one-third of the web, reported three critical holes, and GitLab Inc. disclosed a 10-out-of-10 severity vulnerability affecting all versions since 2014.
  • Data Breaches: Reports indicate a massive data theft involving California public school students since 2023, and a breach affecting 970,000 Medi-Cal patients. The State Bank of India has also confirmed a data breach.
  • Corporate and Cloud Impact: Cloud-based services have faced significant pressure, including a breach at TiDB Cloud and a password stealer planted in an OVHcloud tool. The company Zeabur reported 321,810 breached accounts and has announced it is shutting down.

The Role of Artificial Intelligence

The escalation of these attacks highlights an intensifying AI-driven cyber arms race. CrowdStrike Holdings Inc. has identified four AI-powered hacking campaigns, and reports suggest that China-linked hackers have used AI agents to target over 2,250 cloud tenants, gaining privileged access in some instances in under three hours.

The use of AI has become a double-edged sword in the sector. While attackers are using AI tools to automate breaches—such as the “Carn” tool used against over 100 companies—security professionals are also utilizing AI to audit codebases and manage rapid responses. Madeline Lawrence, co-founder of Aikido Security, noted that the speed at which attackers can use AI to exploit flaws has created a continuous race for defenders to deploy patches.