Global Web Services Disrupted as Critical PHP Vulnerabilities Prompt Emergency Patches
Widespread outages occurred after developers disclosed critical flaws in the PHP programming language, leading governments and companies to take sites offline and roll out security updates.
Organizations worldwide are racing to apply emergency patches after developers of the PHP programming language announced the discovery of critical vulnerabilities that could allow unauthenticated remote code execution. The flaws, dubbed “php2shell,” affect multiple past versions of PHP, which powers an estimated 70% of websites.
In the United Kingdom, the government temporarily disabled a number of online services as a precaution. Tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four were partially unavailable, attributing the outages to precautionary measures while security updates were applied. A government spokesperson added that no large public-facing critical services had been affected and that work was ongoing with OpenAI and international partners.
The National Cyber Security Centre’s chief technology officer, Olly Whitehouse, described the incident as “unprecedented” but said there were no indications of successful hacks. He noted that advice sent to affected parties was being acted upon.
Private sector responses included Cloudflare’s chief executive Matthew Prince reporting thousands of exploitation attempts in the hours before the vulnerabilities were disclosed, rising to tens of thousands shortly after the announcement. Amazon confirmed attempts to exploit the flaws but said its services remained operational.
Businesses such as a garage in South Wales reported prolonged downtime affecting routine tasks like processing MOTs, forcing staff to revert to paper documentation. Cyber-security experts warned that the patching process was uneven and emphasized the need for staff well-being to maintain resilience.
The PHP Foundation, which maintains the language, cautioned that under certain conditions an attacker could execute code remotely on vulnerable servers. While no successful attacks have been reported, researchers said the full impact could take months to become clear as organizations continue to remediate the issue.