Microsoft CEO Satya Nadella described a critical cyber-security flaw in PHP, a programming language powering millions of websites, as unprecedented in recent memory. Two critical vulnerabilities were discovered in PHP, prompting national cyber-security authorities to order urgent patching or offline deployment of affected systems.
IT workers reported intense pressure managing the response. Adam Mudd, a UK-based system administrator, said the last 48 hours had been "relentless," with clients demanding sites go offline as a precaution while he coordinated fixes across diverse setups. He worked until 22:30 BST and lost significant sleep. Loganaden Velvindron, an IT administrator in Mauritius, faced similar strain after discovering how many software systems depend on PHP. His team had to rebuild web applications and rewrite code because many running PHP versions were end-of-life.
The PHP Foundation released a patch on Wednesday at 15:00 BST, triggering a rush to download and apply the fix. Jon Jones, technical director at a digital advertising company, described the moment the patch launched as like "a Hollywood action scene" but acknowledged nervousness about whether updates might cause new problems.
The emergency response was amplified by a leaked disclosure of vulnerability details and unconfirmed rumors that cyber-criminals already possessed working attack methods. Cloudflare and AWS warned of "millions of hacking attempts" every hour. However, cyber experts now question whether those warnings reflected reality. Daniel Card, a UK cyber expert, said he and others were frustrated by what he called "rubbish intel" about active hackers. Despite the alerts, there is no evidence of large-scale data breaches or successful cyber-attacks at scale.
A major cyber-security company issued warnings that hackers had working proof-of-concept methods, then retracted them. The messaging problems extended to national leaders, including Japan's Prime Minister, who issued warnings based on preliminary threat assessments.
The flaws themselves remained hidden from human researchers for decades until AI tools discovered them. Workers interviewed agreed that AI-assisted security research would likely uncover serious vulnerabilities more frequently. Mark Maunder, founder of Wordfence, a WordPress security tool, cautioned against the risk of "alert fatigue" as AI capabilities improve, warning that excessive false alarms could desensitize organizations to genuine threats.