The UK government is identifying exposure across its online services after critical security flaws emerged in PHP, the programming language that powers roughly 70 percent of the internet, according to cybersecurity firm Wiz.
The flaws were discovered by artificial intelligence. Details leaked on social media Tuesday, before an official embargo ended, prompting multiple attack attempts on major companies including Amazon. Amazon reported a "PHP2Shell exploitation attempt" on October 17 against one of its decoy security systems, followed by additional attacks on October 21 using different anonymization methods, suggesting multiple attackers acted within hours of the leak.
The US National Security Agency said the vulnerabilities provide attackers "a direct path to the server's file system or database," potentially allowing theft of sensitive data, service disruption or deeper network intrusion. The flaws existed undetected for at least a decade.
The UK's National Cyber Security Centre has urged all organizations to apply fixes. Where immediate remediation is impossible, the NCSC recommended taking systems offline until fully mitigated. The EU and Australian cyber agencies issued identical guidance.
Multiple governments took precautionary action. Finland shut down its public web services. The Netherlands' cybersecurity agency went offline. Wikipedia removed parts of its website. These actions align with US guidance to take systems down if vulnerabilities cannot be immediately addressed.
PHP powers Wikipedia, WordPress, online shops and countless other platforms. When you visit a website, PHP code collects and presents the information you see.
The PHP Foundation planned to release the complete fix later this month. The leaked details accelerated exploitation timelines dramatically. Amazon's security chief CJ Moses noted that AI enables "more actors to act within hours or even minutes once technical details of a vulnerability are disclosed." The Australian Council on AI Strategy CEO Anna-Maria Arabia told the BBC that what previously took months to exploit now takes days. She warned threats would become more common as AI capabilities improve.
OpenAI called the discovery "one of the most impactful security issues in recent memory." A UK government spokesperson urged "all organisations, private and public, large and small" to follow protection guidance. Amazon said it remains unclear how actors learned about the vulnerabilities before the embargo lifted.