In brief
A critical vulnerability in the widely used PHP programming language has forced thousands of websites worldwide to go offline. Governments in the UK and elsewhere shut down multiple services to prevent exploitation while security teams race to patch the flaw. Cloudflare reported a flood of attack attempts spiking into the millions after the breach was disclosed. The vulnerability, dubbed php2shell, allows unauthenticated remote code execution. Technology experts warn that the window for safe patching is shrinking, adding pressure on developers to act fast.
(2) Global scramble as PHP flaw forces worldwide service meltdowns
A critical flaw in PHP – a programming language that powers roughly 70 % of the web – has caused major disruption across the globe. Early on Wednesday, websites powered by PHP went dark, prompting governments and commercial organisations to temporarily shut down services as they race to patch the vulnerability.
The flaw, dubbed “php2shell”, is an unauthenticated remote code‑execution vulnerability that could allow attackers to run arbitrary code on any server that is still using a vulnerable PHP version. The PHP Foundation warned that under the right conditions the flaw could be triggered from outside the network.
Government response
Downing Street warned that 32 government services were offline, with four only partially available, while cyber‑security teams worked to apply mitigations. Parliament’s tech minister, Baroness Lloyd of Effra, said the outages were precautionary, saying “they largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied.”
Industry reactions
Cloudflare logged a dramatic spike in exploitation attempts – “thousands” in the 10 hours before the announcement, hundreds of thousands within two hours, and millions thereafter. Amazon reported efforts to neutralise the risk, while the national cyber‑security centre (NCSC) said it is beginning to receive and act upon advisory messages from the community.
The technical reality
PHP – Hypertext Preprocessor – is a server‑side scripting language that assembles dynamic web pages. It has remained in use for almost three decades, powering high‑profile sites such as Wikipedia, Bank of England, and countless e‑commerce platforms. The php2shell flaw is an inherent weakness in how PHP handles certain types of input, and it applies to many legacy versions.
The urgent call to patch
Cyberscience researcher Matt Hull of NCC Group warned that the “window to respond has shrunk dramatically.” He noted that attackers may move from weeks to days or even hours to exploit new vulnerabilities, intensifying pressure on developers. Hull also highlighted the threat of burnout and called for distributed workload, rest periods, and peer support.
The incident underscores a broader issue: the digital dependencies that underpin modern governance, commerce and daily life are still vulnerable. While no public hacks have yet been confirmed, the scale of attempted breaches suggests the possibility of covert exploitation.
Next steps
Security experts advise that system operators immediately check the PHP version in use, apply the latest security patches, and conduct vulnerability assessments. The NCSC and industry partners continue to issue guidance, and the global tech community is mobilising to defend critical infrastructure against this new threat.
