Organizations worldwide are scrambling to patch critical vulnerabilities discovered in PHP, a programming language that powers approximately 70 percent of the world's websites, after the flaws were publicly revealed this week.
The PHP Foundation warned that the vulnerabilities, termed "php2shell," could allow unauthenticated attackers to remotely execute code on affected servers. No successful attacks have been confirmed, but cyber researchers and security officials say breaches may take months to fully manifest.
The UK government took precautionary action by taking some services offline Wednesday and Thursday. Baroness Lloyd of Effra told the House of Lords that 32 government services became unavailable and four became partially unavailable. A government spokesperson said no large public-facing critical services were affected and the outages resulted from "precautionary measures" while security updates were applied. The government coordinated with OpenAI and international partners on the response.
Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event "unprecedented" and said it would likely affect organizations universally. He reported "no indications" of successful breaches despite the vulnerability's severity.
PHP, developed in the early 1990s, runs server-side code for dynamic web pages. The language powers platforms including Wikipedia, WordPress, online shops and web application frameworks like Laravel and Symfony.
Matthew Prince, chief executive of internet infrastructure firm Cloudflare, documented escalating exploitation attempts on X. The company detected thousands of attempts to exploit the flaw in the 10 hours before public announcement. This jumped to tens of thousands within 45 minutes of disclosure, hundreds of thousands within two hours, and millions thereafter. Amazon reported similar exploitation attempts but said its websites operated normally.
Some sites including parts of Wikipedia, Finland's government website and a Dutch cyber-security agency went temporarily offline Wednesday. Orange, a French telecommunications company, suspended access to certain services globally to deploy security fixes. A UK garage owner told BBC Your Voice he could not process MOT certificates online since Wednesday morning due to system outages, forcing him to maintain paper records and causing customer delays.
Cyber-security researchers using server scans report that organizations are patching systems more slowly than necessary given the compressed response window. The PHP Foundation's identification that the flaws affect many past versions of the language has widened the scope of required updates.