In brief
A previously hidden flaw in the PHP backend language has triggered widespread website outages, prompting emergency patching across the globe. Government services in the UK were taken down in a precautionary move, while major platforms like Cloudflare reported millions of exploit attempts. Businesses ranging from local MOT offices to international agencies are scrambling to update their systems, with experts warning that patches may still take days to fully mitigate the risk. The incident underscores the speed at which modern cyber threats can surface and the urgent need for resilient infrastructure.
A critical flaw in the PHP backend language – dubbed "php2shell" – has sent a wave of outages across the web. The vulnerability, uncovered by California researchers and the security firm Wiz, allows unauthenticated attackers to run arbitrary code on servers that run affected PHP versions.
Widespread Impact in Minutes
Websites and services started going offline mid‑week as the flaw was disclosed. The UK government pre‑emptively disabled 32 services and had 4 partially offline, citing precautionary measures. Meanwhile, Cloudflare logged thousands of exploit attempts in the hours before the public alert and saw a surge to millions within two hours after the announcement.
Government Response
The House of Lords briefed that no critical public‑facing services were compromised. "We are working closely with OpenAI and international partners on this issue," a spokesperson said, emphasizing that the outages were pre‑emptive. Cyber‑security chief Olly Whitehouse called the event "unprecedented" and noted that no successful hacks had been reported yet, though the impact could take months to materialise.
Businesses in Disarray
Small‑scale operations felt the brunt. A garage‑based MOT office in Chepstow, South Wales, reported that offline servers forced manual record‑keeping and delayed customer services. Local authorities and agencies worldwide, including a Dutch cybersecurity agency, temporarily shut down to assess vulnerabilities.
The Speed of Exploitation
Cyber‑intelligence experts warn that attackers can now exploit a flaw in days, or even hours, compared to previous weeks. Matt Hull of NCC Group urged the sector to spread the workload and guard against burnout among security teams.
What PHP Powers
PHP remains a staple of the internet: it powers around 70% of websites, including WordPress, Wikipedia, and e‑commerce platforms. The language’s long history means many legacy systems remain vulnerable if not updated.
How to Protect Your Services
- Check PHP version and patch immediately.
- Deploy temporary mitigations such as disabling vulnerable functions.
- Monitor for unusual traffic or exploit attempts.
- Review third‑party plugins and frameworks for known vulnerabilities.
Next Steps
Governments and businesses are coordinating with security researchers and vendors to roll out patches. The incident is a stark reminder of how a single piece of backend code can jeopardise digital infrastructure worldwide.
For further insight and real‑time updates, subscribe to our Tech Decoded newsletter.
