Businesses, governments and website operators worldwide are racing to secure their systems after critical vulnerabilities were discovered in PHP, a programming language used extensively across the internet.
The flaws prompted organisations to temporarily take websites and online services offline while they investigated potential exposure and applied security updates. Although no successful attacks had been confirmed at the time of reporting, cybersecurity specialists warned that the consequences could emerge over the coming weeks or months.
The UK government was among those taking precautionary action. Officials said some public services had been temporarily disrupted as security teams worked to identify and address potential weaknesses.
UK government services affected by precautionary measures
Downing Street confirmed that some government services might remain unavailable while technical teams carried out security checks and installed updates.
Technology minister Baroness Lloyd told the House of Lords that 32 government services were unavailable and another four were partially unavailable. She said the disruption was largely the result of precautionary steps taken to protect systems.
The government did not identify the affected services but maintained that no major public-facing critical services in the UK had been impacted.
Officials said work was already under way to identify and fix potential vulnerabilities, with government cybersecurity specialists collaborating with OpenAI and international partners.
However, authorities stressed that taking services offline did not mean those systems had been hacked.
Olly Whitehouse, chief technology officer at the UK’s National Cyber Security Centre (NCSC), described the incident as unprecedented and suggested its effects would be felt widely. Nevertheless, he said there were no indications of successful security breaches.
The NCSC also reported encouraging signs that organisations were receiving and acting on its security guidance.
Getty ImagesCyber researchers at Calif and Wiz unearthed the php2shell flaw, theorised by the PHP Foundation in 2024, in part using OpenAI tools
Small businesses are also experiencing disruption
The effects have extended beyond government infrastructure and major technology companies.
Dean Presley, who operates a garage in Chepstow, South Wales, told BBC Your Voice that his computer system had been unavailable since Wednesday morning, preventing him from properly processing vehicle MOT tests online.
Although inspections could still be carried out legally, he could not access the normal system to produce certificates and associated paperwork. As a result, he had to record information on paper, creating delays for customers.
The disruption illustrates how vulnerabilities in widely used software can affect everyday services, even when individual businesses have not been directly targeted.
What is PHP, and why is the vulnerability significant?
PHP stands for PHP: Hypertext Preprocessor. It is a server-side programming language that helps websites process information and generate the pages users see in their browsers.
Developed in the early 1990s, PHP remains an important part of internet infrastructure. It is used by platforms such as WordPress and Wikipedia, as well as online shops and web applications built with frameworks including Laravel, Symfony and Drupal.
Cybersecurity company Wiz, which helped uncover the vulnerabilities, estimates that PHP powers around 70% of websites worldwide.
The newly identified weaknesses have been dubbed “php2shell” and affect multiple versions of the language. Researchers warned that, under certain conditions, an attacker could exploit the flaws to execute code remotely on a vulnerable server without first authenticating.
Such access could potentially allow attackers to compromise affected systems, depending on the server’s configuration and the protections in place.
The PHP Foundation, the non-profit organisation responsible for maintaining the language, acknowledged the seriousness of the vulnerabilities and the need for affected operators to take action.
Exploitation attempts increased rapidly
Cybersecurity companies reported a sharp rise in attempts to exploit the vulnerabilities after information about them became public.
Matthew Prince, chief executive of internet infrastructure company Cloudflare, said the company observed thousands of exploitation attempts across its network during the 10 hours before public disclosure.
According to Prince, the volume increased to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours and eventually millions.
Amazon also reported attempts to exploit the flaws, although it said its websites continued operating normally.
The activity highlights how quickly attackers can begin targeting newly disclosed vulnerabilities, leaving organisations with limited time to assess their exposure and apply effective protections.
Websites and online services temporarily taken offline
Several organisations temporarily restricted access to their services while investigating the threat.
Websites belonging to a Dutch cybersecurity agency, Finland’s government and parts of Wikipedia had reportedly returned to normal operations by Thursday after being taken offline temporarily.
French telecommunications company Orange also said it had suspended access to certain services globally while deploying security fixes.
Other organisations continued checking whether their systems used affected PHP versions and whether additional updates or protective measures were necessary.
Cybersecurity specialists warned that patching progress remained uneven, with some organisations moving more slowly than the situation demanded.
Matt Hull, vice-president of cyber intelligence and response at NCC Group, said attackers could now move from discovering a vulnerability to attempting exploitation within days or even hours, rather than the weeks that might once have been available.
He also cautioned that the intense pace of response work could leave cybersecurity professionals exhausted, emphasising that organisations needed to share workloads and allow staff time to rest.
AI’s role in uncovering the security flaw
Researchers at Calif and Wiz identified the vulnerability using a combination of security research techniques and AI tools. The PHP Foundation had also theorised about the underlying issue in 2024.
The discovery has renewed attention on the growing role of artificial intelligence in cybersecurity research, including its potential to help researchers uncover serious weaknesses in widely deployed software.
However, the ability to identify vulnerabilities also raises the stakes for organisations responsible for maintaining affected systems. Once a flaw becomes public, malicious actors may attempt to exploit it just as quickly as defenders work to close it.
What happens next?
The immediate priority for affected organisations is to determine whether their infrastructure uses vulnerable PHP versions, apply the appropriate security updates and verify that systems are adequately protected before restoring services.
Even after patches are deployed, cybersecurity teams may need to continue monitoring systems for suspicious activity and investigate whether any compromise occurred before protections were applied.
Although no successful attacks had been reported at the time of the announcement, specialists warned that the full impact might not become clear immediately.
The incident underscores the risks associated with vulnerabilities in widely used software: a weakness in a single foundational technology can trigger disruption across government services, businesses and websites worldwide.
It also highlights the importance of keeping software up to date, maintaining clear incident-response plans and ensuring cybersecurity teams have the resources needed to respond quickly when critical flaws emerge.
