PHP security flaws trigger global rush to protect websites

The UK government said on 22 October that it was assessing whether its online services were exposed to critical flaws in PHP, as governments and businesses moved to secure websites using the widely deployed programming language. BBC News reported that Amazon had detected attempts to exploit the weaknesses before the public security warning was released.

Britain’s National Cyber Security Centre (NCSC), alongside authorities in the EU and Australia, urged organisations using PHP to apply fixes. The NCSC advised considering taking affected systems offline if they could not immediately be secured.

Precautionary shutdowns have already affected public services: the Dutch cybersecurity agency went offline, Finland’s government suspended its public web services, and Wikipedia disabled parts of its website. These shutdowns were reported as protective measures, not evidence that the services had been successfully breached.

Amazon reports attempts before public disclosure

Amazon said on Wednesday that it had identified an attempt on 17 October to exploit the flaws, which it described as “PHP2Shell”. Its security chief, CJ Moses, said an anonymous internet address targeted one of the company’s honeypots—decoy systems used to detect malicious activity. The reported attempt does not establish that Amazon’s operational services or customer data were compromised.

The PHP Foundation had planned to disclose the discovery later in October alongside a complete patch, but details leaked on social media on Tuesday. Amazon reported further attempts on 21 October, after the leak but before the embargo on the warning ended.

Moses said differences in the attack payloads and the infrastructure used to conceal their origin suggested multiple actors were involved. Amazon said it did not know how attackers had learned about the vulnerabilities.

Why the flaws matter

PHP runs server-side code for online shops and platforms including Wikipedia and WordPress. It helps websites retrieve information and assemble the pages visitors see, making weaknesses in the language potentially significant across many different services.

The US National Security Agency said the vulnerabilities could give attackers access to a server’s files or database, enabling data theft, service disruption or movement further into a network. It stressed that the flaws were in PHP itself, rather than in the applications hosted on it or their configuration.

Cybersecurity company Wiz estimated that roughly 70% of the internet was affected. That estimate was not independently verified by the reporting outlet and should not be read as a confirmed count of vulnerable websites.

AI shortens the response window

The flaws were initially discovered using artificial intelligence. Moses warned that AI also allows more attackers to act within hours—or even minutes—after technical vulnerability details become public.

Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, said the incident illustrated how AI was accelerating the discovery of weaknesses, compressing work that previously took months into days. Her warning concerned the changing pace of cyber threats; it did not establish that AI had been used in the specific attempts Amazon detected.