A set of severe security vulnerabilities discovered in PHP, the programming language underpinning roughly 70% of the world's websites, has triggered days of emergency patching across government agencies and private companies. UK officials confirmed dozens of government services were taken offline as a precaution, while cyber-security researchers reported millions of attempted exploits within hours of the flaws becoming public.
What makes this vulnerability different
PHP - short for PHP: Hypertext Preprocessor - runs behind the scenes on web servers, processing data and assembling the pages people see in their browsers. Developed in the early 1990s, it still powers major platforms including Wikipedia, WordPress-based sites, online stores, and frameworks such as Laravel, Symfony and Drupal. According to cyber-security firm Wiz, which helped uncover the issue, the newly disclosed flaws - informally dubbed "php2shell" - are built into the language itself rather than a single application, meaning many older PHP versions are affected. The PHP Foundation, which maintains the language, warned that under certain conditions an attacker with no prior access could remotely run malicious code on vulnerable servers.
Government and business impact
In the House of Lords, tech minister Baroness Lloyd of Effra said 32 UK government services were unavailable and four were partially affected, stressing these were precautionary shutdowns rather than evidence of successful breaches. A government spokesperson said no major public-facing critical services were affected and that officials were working with international partners to identify and close exposures. Olly Whitehouse, chief technology officer at the National Cyber Security Centre, described the episode as "unprecedented" in scale but said there were "no indications" of confirmed hacks, adding that organizations were increasingly acknowledging and acting on official guidance.
Smaller businesses also felt the disruption. Dean Presley, a garage owner in Chepstow, South Wales, told the BBC his computer system had been down since Wednesday, preventing him from printing MOT certificates and forcing staff to revert to paper records. In France, telecoms operator Orange said it suspended some global services while applying fixes, and outages were briefly reported at a Dutch cyber-security agency, Finland's government site, and parts of Wikipedia before service was restored.
A rapidly shrinking response window
Cloudflare chief executive Matthew Prince said the company logged thousands of exploitation attempts in the ten hours before the flaws were publicly disclosed, a number that jumped to millions within hours afterward. Amazon also reported attempted exploits, though it said its own sites continued operating normally. Matt Hull of NCC Group noted that attackers now move far faster than in the past, sometimes within hours of a vulnerability becoming known, intensifying pressure on security teams. He cautioned that the scale of patching required could strain engineers already working to contain the fallout, urging organizations to pace the response rather than risk burnout among staff.