Tokyo to Helsinki: Why Did Governments Take Websites Offline?

The flaws had lurked for years. AI found them — and then helped attackers exploit them faster than defenders could patch.

Tokyo / Beijing / Amsterdam, October 23, 2026 — Companies and governments worldwide raced on Thursday to patch critical vulnerabilities in PHP, the programming language that underpins much of the internet, as cloud firms reported a surge of hacking attempts running into the millions after the flaws were disclosed.

The escalation curve

Cloudflare and Amazon both reported widespread exploitation attempts. Cloudflare CEO Matthew Prince set out the acceleration in a post on X: in the 10 hours before public announcement there were thousands of attempts to exploit the flaw; that jumped to tens of thousands in 45 minutes after the announcement, hundreds of thousands within two hours, and “millions now.”

The speed is the story. A vulnerability’s public disclosure now functions as a starting gun, compressing the window defenders need from weeks to hours.

Japan’s precautionary blackout

Emergency shutdowns hit some of the most safety-critical services in the world’s third-largest economy. On Thursday, Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway said they temporarily suspended some internet services. Asahi Group Holdings paused certain websites and systems while assessing impact, and Tokio Marine Holdings suspended its group website.

Government systems were affected too: Japan’s Ministry of Finance and Meteorological Agency partially suspended online services, and the National Tax Agency temporarily took its service down. Japanese authorities recorded more cyber incidents in the first nine months of this year than in all of last year, according to data from TrendAI cited by Reuters — context that helps explain the scale of the response.

Europe, China and Korea

France’s Orange said it temporarily suspended access to certain PHP-based websites and applications across several subsidiaries as a precaution. Finland’s state IT provider Valtori shut government public web services on Wednesday, then installed patches overnight and began gradually lifting blocks.

Crucially, Valtori said the outages were not caused by exploitation or a cyber breach, and it was not aware of any active exploitation of the flaws. “Restoring services can take days or even weeks, as in addition to updates, the systems need to be carefully tested,” Director General Hannu Naumanen said.

In China, the industry ministry urged organisations to inspect systems, upgrade to the latest secure PHP version, strengthen monitoring and change accounts, passwords and keys where necessary. Tencent Cloud urged customers to install updated versions but stopped short of calling for widespread shutdowns. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures.

Why PHP — and why now

PHP is a general-purpose language, in the same broad family as HTML and Python, and it quietly powers enormous portions of the commercial and public web. Its developers released fixes on Wednesday for vulnerabilities that had lurked in the software for years until they were uncovered using AI, urging users to “update immediately.”

Madeline Lawrence, co-founder of Belgian security firm Aikido Security, framed the crisis precisely: details of the flaws became public before fixes were ready, with attacks reported since. “Companies are racing to update against attackers who can use AI to exploit them. That’s the whole race.”

Microsoft CEO Satya Nadella, speaking at an event in Germany on Thursday, said he had “not seen anything like this in a long, long time,” adding: “It was a long day and a long night, I know, for all the IT and security folks.” His broader point was structural — the incident underlined the importance of building software that can be maintained securely as systems grow more complex.

Bitkom’s head of security, Felix Kuhlenkamp, noted that while many large operators had already updated, complex IT systems and smaller organisations would take longer — which is exactly where attackers look.

What it means for African businesses

Nigeria’s digital footprint sits on the same rails. PHP-based content systems and frameworks power a disproportionate share of SME websites, e-commerce storefronts, school and church portals, and a chunk of fintech and airline booking infrastructure. The practical lesson from Tokyo is not panic but sequence: patch, then test, then restore — and never assume that a small site is uninteresting, because automated exploitation is volume-driven, not target-driven.

Three things stand out for the coming weeks. First, several fixes may take days or weeks to implement safely, so the exposure window stays open. Second, no confirmed large-scale compromise has yet been publicly attributed to these flaws — the shutdowns so far are defensive. Third, the deeper exposure isn’t the bug; it’s the maintenance debt in old, load-bearing, thinly-maintained open-source code that almost everyone depends on and almost nobody funds.