Millions of hacking attempts as companies and governments rush to patch PHP flaws

What happened

Governments and corporations worldwide worked through the night on Thursday, October 22, 2026, to patch two high-severity vulnerabilities in PHP, the programming language that powers roughly 70% of websites globally, including platforms such as WordPress and Magento, after the PHP Foundation released urgent fixes late Wednesday and urged all users to "update immediately." All of the load-bearing facts in this digest, the exploit counts, the FBI warning and the OpenAI account, currently stand on a single fully read report: AP's nationwide story carried by Bay News 9, which this digest flags at each point below. Per that report, the flaws were uncovered with the help of AI agents: OpenAI said in a blog post, as quoted by AP, that it had led a coalition of researchers and security providers addressing PHP vulnerabilities over the past two months, called the flaws "one of the most impactful security issues in recent memory," and said AI appeared to find the vulnerabilities before any attackers did. Cloudflare CEO Matthew Prince, again as reported by AP, said in a social media post that there had been "millions" of exploitation attempts in the hours since announcement, after his network recorded thousands of attempts in the 10 hours before the flaws were publicly announced. AP further reported that the FBI's cyber division warned Wednesday that the vulnerabilities could allow malicious actors to remotely execute code in PHP, risking the compromise of sensitive data and networks, and recommended operators take websites offline if they cannot update immediately.

The government response, likewise per AP's report, reached the highest levels. Japan's Prime Minister Sanae Takaichi advised administrators to check for PHP use and install the patch immediately, saying that "if it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk." Japanese entities ANA and Nomura, along with Finland's state IT provider Valtori, temporarily suspended services, and Chief Cabinet Secretary Minoru Kihara said no damage from cyberattacks had been reported. In Britain, the prime minister's office said some "limited" government services may temporarily be offline, with a spokeswoman saying experts are "continuing to work closely with both OpenAI and international partners on this issue." Finland's government site said disruption had been resolved but that "some content is still missing and is currently being restored." The EU cyber agency ENISA advised organizations "to take immediate action." None of these government lines has yet been confirmed against a second independently read source.

Why it matters

The scale of exposure is unusual because PHP sits underneath an enormous share of the web: at roughly 70% of websites, the two flaws touched everything from small blogs to large commerce platforms built on WordPress and Magento. The disclosure dynamics added pressure. Cloudflare's figures, thousands of exploitation attempts in the 10 hours before the public announcement and millions in the hours after, are reported by AP and not yet corroborated by a second fully read source; a Reuters page carrying the same counts returned an access error and could not be read for this digest, so they should be treated as standing on AP's reporting alone. Those numbers, if confirmed, indicate attackers were probing the flaws both before and immediately after they became public, which is why the FBI's cyber division, per AP, framed taking sites offline as a legitimate fallback for operators who could not patch in time. The episode is also notable for how the flaws were found. OpenAI's account, reported by AP, that an AI-led coalition spent about two months on PHP vulnerabilities and surfaced them before attackers did is a company's own blog-post claim and has not been independently verified here. Governments from Tokyo to London to Helsinki nevertheless treated the patching window as urgent enough to suspend services rather than risk exposure: Japan's ANA and Nomura and Finland's Valtori chose temporary suspension, and Japan's top government spokesman reported no damage from cyberattacks as of Wednesday.

How it is being covered

The story is being carried widely: Ground News counts 56 sources on the story, split 31% left, 47% center and 22% right, with 31 of 36 factuality-rated outlets in the high or very high band, so the coverage base is broad and skews center, though that count measures reach, not independent confirmation. Ground News flags no blindspot, meaning no major partisan segment is absent from the coverage. The only source fully read for this digest is the Bay News 9 piece carrying AP's report; a Reuters corroborating page could not be read (access error) and a BBC live page timed out, so the UK "limited services" line from AP is treated as the confirmed version of the British response.

What to watch

Watch for independent confirmation of the headline figures, since the Cloudflare exploitation counts, the FBI remote-code-execution warning and the OpenAI coalition account each currently rest on AP's single report. Watch for follow-up reporting on whether the millions of attempts produced confirmed compromises; Japan's government has so far reported no damage and Finland says disruption is resolved. Watch for further detail from OpenAI and its coalition on how the AI-led discovery process worked, and from the PHP Foundation on additional fixes. Watch whether more organizations follow ANA, Nomura and Valtori in suspending services, and whether the UK's "limited" offline services return to full availability. Cloudflare's running counts of exploitation attempts, as relayed by AP, remain the clearest public gauge of attacker activity.

By the numbers

Source snapshot