The PHP Foundation began warning organisations this week that “php2shell”, a set of critical flaws inherent to the programming language itself, could let an unauthenticated attacker remotely execute code on servers running affected versions. The disclosure set off a global patching scramble, and the operational fallout is still being counted.
PHP is not a niche technology. According to cyber-security firm Wiz, which helped uncover the vulnerabilities, it powers 70% of the world’s websites. Developed in the early 1990s to serve dynamic web pages, it still runs platforms including Wikipedia, online shops, WordPress, and frameworks such as Laravel, Symfony and Drupal. That reach explains why the disruption spread so fast.
Websites around the world went offline on Wednesday and Thursday as the flaws were revealed. The UK government was among those to pull services as a precaution. Downing Street said on Thursday that “some” limited government services “may be offline” while security work was carried out, though it did not specify which. Tech minister Baroness Lloyd of Effra gave the House of Lords a firmer figure: “The information I have is that 32 Government services are unavailable and four are partially unavailable.” She attributed the outages to precautionary measures taken while security updates and mitigations are applied, adding that no large UK public-facing critical services had been affected.
A government spokesperson said work had already taken place across government to “identify and fix potential exposures to our systems”, with experts continuing to work closely with both OpenAI and international partners. “But this does not mean they were hacked, and work continues to resolve any issues,” they said. Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event “unprecedented” and said it would be “universally felt”, though he noted there were “no indications” of successful breaches and that the NCSC was “starting to see positive confirmation” that its advice was being received and acted on. Cyber-security lecturer Rory Hopcraft told the BBC the government needed to ensure its own infrastructure was up to date, saying it sets the rules for other organisations and “just need to effectively be practising what they’re preaching at this point”.
The delivery problems reach well beyond Whitehall. Dean Presley, who runs a garage in Chepstow, South Wales, told BBC Your Voice his computer system had been down since Wednesday morning, leaving him unable to process MOTs online. MOTs can still be conducted and are legal, he said, but paperwork and certificates cannot be printed or recorded on the system, forcing him to write everything on paper and delaying customers.
Elsewhere, recovery is under way, unevenly. The website of a Dutch cyber-security agency, Finland’s government and parts of Wikipedia, all temporarily offline, had returned to normal by Thursday, though other sites were still being taken down as operators checked whether PHP was running in their systems. In France, telecoms company Orange said it had suspended access to certain services globally while deploying security fixes. Matthew Prince, head of internet infrastructure firm Cloudflare, wrote on X that his company saw thousands of exploitation attempts in the 10 hours before the flaws were announced, jumping to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions now. Amazon said it also saw attempted exploitation but its websites were operating as normal.
No successful attacks have been reported so far, but experts caution that any impact may take months to become fully apparent. Matt Hull, VP of cyber intelligence and response at NCC Group, said “the window to respond has shrunk dramatically”, noting that exploits which once took weeks can now unfold in days or hours. He also warned of burnout among security professionals days into the incident, urging teams to rest and share the workload: “Resilience depends on people as much as technology.” Further background on the story is available at https://www.bbc.co.uk/news/articles/c9j34zgmkxx1o.