Critical PHP flaw sparks global website shutdowns as cyberattacks surge

A critical security flaw in a programming language used by a large proportion of the internet has triggered emergency measures across governments and businesses, with cybersecurity experts warning that disruption could spread as hackers exploit vulnerable systems.

Millions of attempts to exploit the vulnerability have been recorded since details of the flaw became public, according to Cloudflare, as website operators race to install security updates and prevent potential attacks.

The vulnerabilities affect PHP, a widely used programming language that powers websites and supports platforms such as WordPress, Drupal, Joomla and Magento.

Cloudflare chief executive Matthew Prince said the company observed thousands of exploitation attempts before the flaw was publicly disclosed, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and eventually millions.

Amazon Web Services has also warned that the vulnerability is being widely exploited, raising concerns that organisations yet to secure their systems could face further attacks.

Several government agencies and businesses in Europe temporarily shut down websites on Wednesday as a precaution while technical teams worked to apply security fixes.

The UK’s Office for Budget Responsibility took its website offline because of the security issues affecting PHP. Oxfordshire County Council and Hillingdon Council also reported temporary shutdowns while investigating their exposure.

In Finland, public web services were taken offline by state IT provider Valtori, while France’s Interior Ministry placed its websites into preventive maintenance.

Several organisations in the Netherlands, including government services and the Port of Rotterdam, also took precautionary action. Authorities in Belgium and Germany reported similar security measures involving public-facing websites.

The shutdowns were intended to reduce the risk of compromise while organisations assessed their systems and applied the necessary updates. Taking a website offline as a precaution does not, by itself, mean it has been hacked.

The PHP developers have released updates addressing two critical vulnerabilities and urged users to upgrade their software immediately.

The flaws received a severity rating of 9.2 out of 10 under the CVSS v4.0 system, indicating a high level of risk.

Alp Toker, director of internet monitoring organisation NetBlocks, warned that disruption could become more widespread as malicious actors attempt to exploit organisations that have not yet installed the fixes.

He said the vulnerabilities could expose web servers to unauthorised access, potentially allowing attackers to compromise systems running affected software.

Toker also warned that artificial intelligence tools could make it easier for attackers to reproduce and deploy exploits, increasing the pressure on organisations to secure their infrastructure quickly.

Cybersecurity officials have advised organisations to identify vulnerable systems, install the available updates and monitor their networks for signs of compromise.

The UK’s National Cyber Security Centre has urged public and private organisations to assess their exposure and take appropriate protective measures. The US National Security Agency and Australia’s cybersecurity authorities have also called for urgent action.

Organisations unable to apply the necessary fixes have been advised to consider temporarily taking affected systems offline until they can be secured.

PHP is used by a substantial share of websites worldwide, making security weaknesses in the language a concern for governments, businesses, publishers and other organisations that depend on online services.

The vulnerabilities could allow unauthenticated remote code execution, a type of security weakness that may enable an attacker to run malicious commands on an exposed server without first logging in.

Depending on the system affected, successful exploitation could lead to data theft, website defacement or a wider compromise of the underlying server and its connected resources.

The discovery also highlights the growing role of artificial intelligence in cybersecurity. Researchers used AI-assisted techniques to identify the vulnerabilities, helping developers investigate and address weaknesses in widely deployed software.

OpenAI described the flaws as among the most consequential security issues in recent memory, while warning that the same advances that help researchers uncover vulnerabilities could also make it easier for attackers to develop exploits.

Cloudflare has introduced additional protective measures as it responds to emerging attack attempts, although the company has described some of its measures as temporary safeguards rather than a substitute for installing the official fixes.

The PHP development team has urged users to update affected software, while cybersecurity agencies continue to press organisations to identify exposed systems and close the security gaps.

The immediate priority is to ensure vulnerable servers receive the necessary updates, particularly as exploitation attempts increase and organisations face the risk of attacks before their systems are fully secured.