PHP security flaws trigger global patching rush and outages

Businesses and public bodies worldwide rushed to secure systems on 22 October after critical flaws in PHP, a widely used web programming language, prompted website shutdowns on Wednesday and Thursday. BBC News reported that 32 UK government services were unavailable and four were partially unavailable, largely because of precautionary security measures.

No successful attacks had been reported at the time of the account. That distinction matters: services being taken offline to install fixes does not establish that attackers accessed them. Security experts nevertheless cautioned that the full consequences could take months to emerge.

A server-level risk with broad reach

The vulnerabilities, dubbed “php2shell”, could allow an attacker without authentication to execute code remotely on a PHP server under certain conditions, according to the PHP Foundation. The flaws affect multiple earlier versions of the language, making the response more extensive than fixing an isolated website.

PHP runs behind the scenes on web servers, helping turn data into pages visitors can use. It is used by platforms including Wikipedia and WordPress, online shops and numerous web applications.

Cybersecurity company Wiz, which helped uncover the vulnerabilities, estimated that PHP powers 70% of the world’s websites. That estimate describes the language’s reach, not the number of sites confirmed to be exploitable or compromised.

Researchers at Calif and Wiz uncovered the flaws partly using OpenAI tools, following a risk theorised by the PHP Foundation in 2024. The reporting does not establish that AI alone discovered the vulnerabilities.

UK services disrupted as fixes are applied

Technology minister Baroness Lloyd of Effra told the House of Lords that the government-service outages largely reflected measures to protect systems while updates and mitigations were installed. Officials did not identify the affected services, but said no large UK public-facing critical services had been affected.

The government said its experts were working with OpenAI and international partners to identify and address potential exposure. It stressed that the disruption did not mean its systems had been hacked.

Olly Whitehouse, chief technology officer at the UK’s National Cyber Security Centre, said there were no indications of successful breaches. He also said the centre was receiving confirmation that affected organisations had received its advice and were acting on it.

The disruption had practical costs for businesses. Dean Presley, a garage operator in Chepstow, South Wales, said his computer system had been down since Wednesday morning, preventing normal online processing of MOT vehicle tests. He said tests could still legally proceed, but certificates could not be printed and records were not appearing on the system, forcing paper-based work and delaying customers.

Attack attempts rise while some websites recover

Cloudflare chief executive Matthew Prince said on Thursday that his company had detected thousands of exploitation attempts across its network in the 10 hours before the vulnerabilities were publicly announced. He said the count rose to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and subsequently millions. These were reported attempts, not evidence of successful intrusions.

Amazon also reported attempts to exploit the flaws, while saying its websites continued to operate normally.

By Thursday, the website of a Dutch cybersecurity agency, Finland’s government website and parts of Wikipedia had resumed normal operations after temporary shutdowns. Other operators were still checking their systems. French telecommunications company Orange said it had suspended access to some services globally while deploying security fixes.

Matt Hull, vice-president of cyber intelligence and response at NCC Group, warned that defenders now face much shorter response windows: exploitation that once might have taken weeks can begin within days or hours. He also urged security teams handling the prolonged incident to share workloads and make time for rest.