Microsoft CEO says PHP flaw crisis unlike anything in years

Microsoft ↘ 0.06% CEO Satya Nadella said Thursday that the global scramble over flaws in the PHP programming language had no recent parallel. "I've not seen anything like this in a long, long time," he said at a company event in Cologne, Germany, Reuters reported. He added that "it was a long day and a long night, I know, for all the IT and security folks," according to The Independent.bbc.com+1

His remarks came after PHP's developers released fixes on Wednesday, Oct. 21, for two vulnerabilities that had sat in the software for years before AI helped uncover them. Since then, governments and companies have been working through patches while hacking attempts climb into the millions, Reuters reported.bbc.com

Millions of attack attempts

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell," let attackers run code remotely on servers that haven't been patched, Fortune reported. An estimated 70% of websites use PHP. Cloudflare ↘ 2.77% CEO Matthew Prince said exploit attempts rose from thousands before the announcement to "tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now," per Reuters. Amazon Amazon.com, Inc. ↗ 0.59% said it spotted an exploit attempt against one of its decoy systems on Oct. 17, four days before the flaws were made public, and that PHP2Shell "is now being broadly exploited in the wild," ABC News reported.fortune.com+2

Security firm Calif found the flaws in August using OpenAI's GPT-5.6 Sol model, as part of an audit of PHP's code that OpenAI paid for, AFP reported. Wiz Research also found them on its own. PHP 8.1 and earlier versions will not get an official fix, according to Investing.com.afp.com+1

Shutdowns from Tokyo to Helsinki

In Japan, Nomura ↗ 0.11%, Mitsubishi UFJ Financial Group ↘ 0.09%, ANA and East Japan Railway temporarily suspended some online services. Asahi Group Holdings and Tokio Marine Holdings took websites down too, Reuters reported. France's Orange ↘ 0.81% restricted some PHP-based sites. Finland's state IT provider Valtori warned that restoring services "can take days or even weeks," while South Korea raised its private-sector cyber alert level. The US National Security Agency told organizations to stay on "heightened awareness" in the coming weeks, NPR reported.npr.org+1

Fatigue and misinformation

IT workers told the BBC the past 48 hours have been draining. "It's been relentless," said UK system administrator Adam Mudd, according to the BBC. Experts there said false reports about working exploits made the panic worse, though so far there is no evidence of large-scale breaches. Wordfence founder Mark Maunder warned that "we need to refine our messaging" before AI tools surface more flaws like these, the BBC reported.bbc.com