A flaw hidden for a decade in PHP sparks a global race to patch or pull the plug

PHP powers an estimated 70% of websites, and newly discovered vulnerabilities in the language could allow attackers to take control of web servers without authentication. Governments and cyber-security agencies worldwide have urged website operators to patch their systems immediately or take platforms offline rather than risk exploitation.

The vulnerabilities went undetected for at least a decade, lurking in code that underpins much of the internet. Prof Alan Woodward from Surrey University said the flaw affects some 30 million websites. An attacker, he said, can get their own code onto a web server and run it, stealing data, moving into other parts of a network, or planting a backdoor to return later. Patches were rolled out by PHP developers on Wednesday to address the issues, which sit in parts of PHP that nearly every web request touches. The PHP Foundation said the central role of those components made the vulnerabilities both serious and hard to fix without breaking compatibility or hurting performance. The discovery has prompted one of the most dramatic public responses to a cyber threat in years, with organisations choosing downtime over exposure. OpenAI, whose technology was used in the discovery process, called it one of the most impactful security issues in recent memory.

Sites go dark

The response has been swift and unusually public. Wikipedia and its parent organisation, Wikimedia, took down parts of their website as a precautionary measure. The Finnish government shut down public web services. Edinburgh council took its website offline. The Dutch cyber-security agency pulled its own website offline as a precaution. A number of Scotland’s public organisations, including councils and health boards, took their websites offline. The UK government said it is working to identify any potential exposure in its online services.

Patch or pull the plug

The US National Security Agency told organisations using PHP to take systems offline if they could not patch immediately, and said the flaw could provide a direct path to a system’s database or file system. The UK’s National Cyber Security Centre issued guidance to patch or take systems offline, advising organisations to check for backdoors installed by an attacker. Cyber-security agencies in the EU and Australia issued similar alerts. Japanese Prime Minister Sanae Takaichi urged people to check whether their publicly available websites ran on PHP and to take action, writing on X that there was an urgent request for everyone to act that night.

Where the bugs lived

PHP is an open-source scripting language over 30 years old, short for PHP: Hypertext Preprocessor. The patch only works on the latest version of PHP, meaning older sites need to upgrade first before they can apply the fix, adding a layer of complexity for organisations running legacy systems.

AI finds what years missed

AI was used to help discover the vulnerabilities, identifying issues in a much shorter time frame than humans could. The security firm Wiz was involved in uncovering the flaws. Separately, OpenAI’s Patch the Planet program discovered the issue at the same time as a researcher named Ryan A in mid-August. Cyber security researcher Ryan Austin said he discovered the flaw and called it the most serious vulnerability he had ever found, describing PHP as one of the first web languages that powered the early internet. It’s in a lot of places that you wouldn’t expect to be that are basically very core to how the internet runs, he said, like all the old things in a house that keep it running but you don’t really think about. The disclosure had been embargoed until 22 October to give websites time to prepare, but details leaked on social media and forums ahead of the embargo, forcing early disclosure.

Attacks before the warning

Amazon identified a PHP2Shell exploitation attempt on 17 October on a honeypot system from an anonymous IP address, four days before public disclosure. Amazon security chief CJ Moses said subsequent attacks on 21 October showed varied payloads and anonymisation infrastructure, suggesting multiple actors. Cloudflare and Palo Alto Networks reported that millions of attempts had been made. Security firm Hadrian said it was seeing exploitation happening at scale. As of one source’s writing, however, there were no reports that anyone had succeeded in using the flaws to attack a site, leaving the threat poised between active attempts and confirmed damage.