PHP vulnerability triggers millions of attack attempts as organisations rush to patch systems

Millions of attempts have been made to exploit a newly disclosed vulnerability in PHP, the programming language used by about 70% of the world’s websites, cybersecurity companies have reported. The flaw has prompted governments and businesses to take websites offline while applying a patch, with experts warning that exposed servers could be taken over and used to steal data or disrupt services. In the UK, 32 government services had been taken offline, cybersecurity minister Liz Lloyd told parliament.

She said the measure was largely precautionary. Downing Street said no public-facing critical services had been affected and that temporary outages did not indicate that the sites had been hacked. The National Cyber Security Centre sent 50,000 alerts to organisations believed to be affected.

It said it had received no reports of successful compromises resulting from the flaw. The Guardian reported that the BBC’s Traitors website, the Internet Archive, Wikipedia and 4Chan were among the sites temporarily affected, although the UK government did not identify its own services. The vulnerability is known as PHP2Shell.

The US National Security Agency warned that it could allow attackers to seize control of web servers, steal sensitive information, disrupt services and move further into networks. The flaw is especially significant because PHP supports a large proportion of the internet, including systems used by schools, local authorities and charities that may have fewer cybersecurity resources. The scale of attempted exploitation increased rapidly after the problem became public.

Matthew Prince, chief executive of Cloudflare, said the company detected tens of thousands of attempts within 45 minutes, hundreds of thousands within two hours and millions thereafter. Cloudflare also said it had seen thousands of attempts in the 10 hours before the public announcement. Amazon Threat Intelligence said the vulnerability was being broadly exploited in the wild and identified attempts by multiple actors to test ways to use it before developers released the fix.

However, researcher Ryan Austin of Calif, who was involved in discovering the flaw, said exploitation did not at that point appear to have become widespread. The reports therefore distinguish between a very large volume of attempts and confirmed successful intrusions. The patch may not work for organisations running older systems, the NCSC warned.

Those organisations may have to replace systems rather than simply update them. The disruption has raised concerns about smaller organisations that lack dedicated security teams, though the British Chambers of Commerce said businesses had not yet reported significant difficulties. Experts have differed in their assessment of the immediate threat.

Former NCSC chief executive Ciaran Martin called the flaw “very bad” and described it as the most serious vulnerability discovered in five years. Former GCHQ director David Omand warned that Russia and China might seek to exploit it. Internet infrastructure expert Michał Woźniak said criminals, state-backed hackers or cryptocurrency miners could hide on compromised servers and use their computing power or network addresses.

The handling of the disclosure has also drawn criticism. Professor Alan Woodward said the flaw became public one day before the patch was released, suggesting that someone had revealed the vulnerability prematurely. Sky News separately reported that experts warned disruption could spread in the coming days.

The Guardian’s report ends while describing further research from Wiz, without supplying the organisation’s conclusions in the available material. The verified position from the reports is therefore that exploitation attempts have reached the millions, widespread patching and precautionary shutdowns are under way, and no successful attack linked to the flaw had been reported by the UK’s cyber authorities at the time covered.