In brief
A severe flaw in PHP, used by 70% of the world's sites, sparked a worldwide scramble to patch servers. In the first 24 hours, hundreds of thousands of sites—including UK government services—went down. The US firm Cloudflare reported a surge of exploit attempts, and the UK government has shut 32 essential services as a precaution. Experts warn that the legacy code base makes patching urgent, with a shrinking window to respond. While no successful hacks have been confirmed yet, the incident highlights the need for swift action.
A critical flaw in PHP, the server‑side scripting language that powers about 70% of the world’s sites, has forced an emergency pause on services worldwide. Within 24 hours, major applications from government portals to e‑commerce platforms went offline.
The flaw, dubbed 'php2shell', lets an unauthenticated attacker execute code on any PHP server. According to security firm Wiz, the vulnerability lies in the language’s core and affects older PHP versions still in use.
In the UK, the government temporarily shut 32 services and partially disabled four others to apply security patches. Downing Street said the move was precautionary; it confirmed that no vital national services were compromised.
Cloudflare reported that in the 10 hours before the public announcement, its network saw thousands of attempts to exploit the flaw; the number spiked to millions in the hours that followed. Amazon noted similar probing, though its websites operated normally.
Security agencies across the globe are rushing to patch servers. The National Cyber Security Centre (UK) said it was receiving guidance from OpenAI and other partners, and experts warn that the window to address the flaw has shrunk to days or even hours.
Critics say the incident exposes deep‑rooted code‑base fragility and the urgent need for improved testing. A government spokesperson emphasized that “no service was hacked” yet, but work is continuing to tighten security.
Businesses with PHP on their stack—ranging from small shops to large public sector portals—are urged to verify whether their systems are affected and apply the latest updates immediately. The rush to patch illustrates the interconnected nature of today’s web: a single flaw can disrupt services worldwide.
