[Edaily Reporter KIM JUNG YOU ] Following the discovery of a critical security vulnerability in the programming language "PHP," government agencies and global companies around the world have begun rolling out emergency patches. Immediately after the vulnerability was disclosed, global hacking attempts exploiting it surged to millions, causing widespread chaos, including the simultaneous suspension of major services as a precautionary measure.

According to Reuters on the 22nd (local time), banks, airlines, railways, tax agencies, and government websites from Tokyo, Japan, to Helsinki, Finland, were temporarily shut down that day. This is considered one of the most serious security crises to date, testing the security of legacy programming tools that have underpinned the internet for decades.

Satya Nadella, CEO of Microsoft (MS), warned at an event in Germany that day, “I haven’t seen a situation this serious in a long time,” adding, “This incident clearly demonstrates how important it is to build software that can be securely maintained as systems become more complex.”

PHP is considered one of the core programming languages underpinning the web, alongside HTML and Python. Recently, the PHP development team used the latest AI technology to discover a vulnerability that had been hidden in the code for years and released an emergency security patch on the 21st. The PHP development team urged users worldwide to “update immediately.”

However, as details of the vulnerability were disclosed before the patch was fully deployed, a wave of coordinated attacks by hackers began. According to cloud service providers Cloudflare and Amazon, hacking attempts surged dramatically immediately after the vulnerability was disclosed.

Matthew Prince, CEO of Cloudflare, stated, “Attack attempts, which were in the thousands during the 10 hours prior to disclosure, rose to tens of thousands within 45 minutes of the announcement, to hundreds of thousands within two hours, and now number in the millions.” Hackers are also using AI to instantly scan for and exploit the vulnerability, leading to a “race against time” with companies.

The impact of this incident has spread worldwide. In Japan, major companies such as Nomura Securities, Mitsubishi UFJ Financial Group, ANA, and JR East suspended their internet services on an emergency basis. Asahi Group Holdings and Tokio Marine also took their websites offline. Government agencies, including the Ministry of Finance, the Japan Meteorological Agency, and the National Tax Agency, also temporarily suspended their online services and began emergency inspections.

In Europe, Finland’s state-owned IT service provider, Valtori, blocked government public web services and worked through the night to apply patches. Hannu Naumanen, Director General of Valtori (ICT Center), explained, “Since not only updates but also thorough testing are required, it may take several days to several weeks to fully restore services.” In France, the telecommunications company Orange also blocked access to some PHP-based apps and websites.

The South Korean government also issued a cyber crisis alert for the private sector and activated its emergency response system, while China’s Ministry of Industry and Information Technology recommended that operators nationwide immediately inspect their systems, apply patches, and change account passwords.

ICT experts are warning that, unlike large corporations, small and medium-sized enterprises (SMEs) with weak in-house IT management or websites using outdated versions of PHP may need to completely replace their entire systems, meaning the aftermath of this incident could be prolonged.