Millions of Hacking Attempts Slam AI-Found PHP Flaws as Nadella Says He's 'Not Seen Anything Like This'

By Hamza Faisal

The internet is living through one of its most frantic security sprints in years. Companies and governments spent Thursday racing to patch two critical flaws in PHP, the programming language behind a huge share of the web, as cloud providers reported millions of hacking attempts in the hours after the vulnerabilities went public.

Microsoft CEO Satya Nadella, speaking at a company event in Cologne, Germany, put it bluntly: "I've not seen anything like this in a long, long time." He added that "it was a long day and a long night, I know, for all the IT and security folks" — and warned the episode shows why digital systems must be built to be maintained securely as they grow more complex.

Millions of attempts in hours

Cloudflare CEO Matthew Prince said attack attempts climbed from just thousands in the ten hours before the disclosure to millions within hours of it. Amazon also reported widespread exploitation of the flaws, which allow remote code execution on any PHP installation serving web requests.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were uncovered with the help of AI and carry severity ratings of 9.2 out of 10. PHP's developers shipped emergency fixes on Wednesday in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging users to "update immediately." Versions 8.1 and older no longer receive official updates.

Belgian security firm Aikido Security said details of the flaws became public before the fixes were ready — and attacks were already being reported. "Companies are racing to update against attackers who can use AI to exploit them," co-founder Madeline Lawrence said. "That's the whole race."

Banking, airlines and governments go dark

The scramble has produced some of the most dramatic precautionary shutdowns in recent memory. Banking, airline, rail, tax and government services went offline from Tokyo to Helsinki as operators pulled systems to patch them, exposing how deeply institutions depend on code that few people ever think about.

Asian governments moved fast on Thursday. China's industry ministry urged organizations to inspect their systems, upgrade to the latest secure PHP version, strengthen monitoring, and rotate accounts, passwords and keys. South Korea raised its private-sector cybersecurity alert level and activated emergency response measures over the heightened risk of hacking attacks.

Singapore's Cyber Security Agency chief executive Gwenda Fong called the threat immediate, noting working exploits had already been demonstrated. Her agency is working with government bodies, critical-information-infrastructure owners and major enterprises to accelerate patching, while reaching smaller organizations through industry partners.

Fixes could take weeks for some

Not everyone can patch overnight. Felix Kuhlenkamp, head of security at German digital industry association Bitkom, said many larger operators had already updated, but complex IT systems and smaller organizations would need more time. Sites running old PHP versions that no longer get security updates must upgrade their entire systems — a job that could take weeks.

One bright spot: Swiss firm Valtori said its outages were not caused by exploitation of the flaws and that it was not aware of any active exploitation in its case. Still, with the flaws details public and automated attacks accelerating, security teams everywhere are treating the next few days as a race they cannot afford to lose.

By Hamza Faisal