Critical vulnerabilities found in PHP language trigger global security scramble

On October 22, 2026, organizations worldwide began an urgent operation to patch critical vulnerabilities in the PHP programming language following a surge in malicious exploitation attempts. The flaws, which had existed in the software for years, were recently uncovered using artificial intelligence, leading PHP developers to issue mandatory updates on Wednesday. The disclosure of these vulnerabilities caused numerous government websites across Europe and other regions to go offline as operators scrambled to secure their systems.

According to Matthew Prince, CEO of cloud services firm Cloudflare, exploitation attempts escalated rapidly following the public announcement. Prince reported that while thousands of attempts occurred prior to the disclosure, the volume grew to millions within a few hours. In response to the threat, authorities in Asia have implemented emergency cybersecurity protocols. Specific impacts include the temporary suspension of internet services by the Japanese lender Mitsubishi UFJ Financial Group, as well as the partial removal of online content by Japan’s Finance Ministry to prevent unauthorized access.

The vulnerabilities allow attackers to execute malicious commands on affected systems. Developers have strongly advised all users to install the provided security fixes immediately to mitigate the risk of ongoing cyberattacks.