Companies and governments were racing to fix critical weaknesses in PHP on 22 October, after its developers issued urgent security updates the day before. PHP is a programming language used to run websites. The weaknesses had been found using AI tools.
In Japan, airline ANA and brokerage Nomura were among companies that temporarily suspended some online services as a precaution. Finland’s state IT provider, Valtori, said it was gradually lifting service blocks, but warned that restoring services could take days or weeks because updated systems also needed careful testing.
Cloudflare’s chief executive, Matthew Prince, said attempts to exploit the flaws across its network had climbed into the millions. That is a count of attempts, not a reported count of successful break-ins. Valtori specifically said its own outages were not caused by a cyber breach.
I keep getting caught on that millions figure. It sounds as though I’ve been given the scale of the damage, when I’ve been given a different measurement. The little word “attempts” has to pull me back. I don’t want the number hidden or softened: a surge in attempts helps explain the urgency. But I’m uneasy about how easily I can carry away an imaginary total of victims without the report ever claiming one.
For someone trying to reach a banking site, that distinction isn’t just careful wording. An attack count across a cloud company’s network doesn’t tell them whether their information was stolen. A blank page doesn’t settle it either. Valtori’s account of its own shutdowns is useful precisely because it says what happened there; it can’t clear every other service. So I’m left taking the enormous number seriously while still wanting a much smaller, more specific answer from each operator: did anyone get in?