The UK government is working to determine whether its online services have been exposed to serious cybersecurity vulnerabilities discovered in PHP, a programming language used by millions of websites worldwide.
Governments and major technology companies are rushing to secure systems running PHP after researchers uncovered critical flaws that could allow attackers to execute malicious code on affected servers.
The vulnerabilities were discovered with the assistance of artificial intelligence (AI), prompting cybersecurity agencies in the UK, European Union and Australia to urge organisations to apply available fixes immediately.
A UK government spokesperson called on “all organisations, private and public, large and small” to follow security guidance and protect their systems.
The National Cyber Security Centre (NCSC) warned that organisations unable to fix the vulnerabilities immediately should consider taking affected systems offline until they can be secured.
Why the PHP vulnerabilities are so serious
PHP is a widely used programming language that helps websites process information and deliver content to users. It underpins major platforms, including WordPress, which powers many blogs and other websites, as well as parts of online shopping services and Wikipedia.
Professor Alan Woodward, of the Surrey Centre for Cyber Security, estimated that the flaws could affect around 30 million websites.
He warned that the vulnerabilities could allow attackers to place and execute their own code on a web server, potentially giving them extensive control over the system.
“They can steal data, they can go to other parts of your network,” Woodward told BBC Radio 4’s Today programme. Attackers could also install a backdoor that would allow them to regain access later, he added.
The US National Security Agency said the vulnerabilities could provide a direct route to a server’s file system or database, potentially enabling criminals to steal sensitive information, disrupt services or move deeper into an organisation’s network.
The agency stressed that the flaws were in PHP itself, rather than necessarily being caused by individual websites or their configurations.
Cybersecurity company Wiz estimated that roughly 70% of the internet could be affected, although the BBC said it had been unable to independently verify that figure.
Amazon detects attempts to exploit the flaws
Amazon said its threat intelligence systems detected an attempted exploitation of the vulnerability on 17 October.
According to the company’s security chief, CJ Moses, an anonymous internet address attempted to target weaknesses in one of Amazon’s decoy systems, known as a honeypot, which is designed to attract and monitor malicious activity.
The company later identified further exploitation attempts on 21 October, after details of the vulnerabilities had leaked online but before the official warning’s embargo was lifted.
Moses said the attacks involved different payloads and anonymisation methods, suggesting that multiple threat actors were involved.
Amazon said it automatically detected and restricted malicious scanning attempts targeting the vulnerability.
The PHP Foundation had intended to announce the discovery later in October alongside a complete security fix, commonly known as a patch. However, details of the flaws appeared on social media on Tuesday, prompting concerns that attackers could move quickly to exploit them.
Moses warned that AI was accelerating the pace at which malicious actors could respond to newly disclosed vulnerabilities.
“More actors can act within hours or even minutes once technical details of a vulnerability are disclosed,” he said.
AI changes the cybersecurity landscape
Cybersecurity researcher Ryan Austin, who has spent 20 years studying PHP security, said he discovered the vulnerability after developing a hunch that he could investigate further with the help of AI.
He described it as the most serious vulnerability he had ever found.
Austin said PHP remained embedded in critical parts of the internet, including systems that users might not realise still relied on the technology.
He compared it to essential components in a house that keep everything functioning but are rarely noticed.
However, he also suggested the incident could prompt organisations to improve their security by ensuring PHP systems are updated promptly.
Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, said the incident demonstrated how rapidly AI was changing cybersecurity.
She warned that tasks which previously took months to uncover vulnerabilities could now take days, adding that the threat was likely to grow as AI technology improved.
The flaws are believed to have remained undetected for at least a decade.
OpenAI described the discovery as “one of the most impactful security issues in recent memory”.
Websites taken offline around the world
Organisations have responded by temporarily shutting down some online services while they assess their exposure or apply fixes.
Several BBC programme websites, including those for Doctor Who and The Traitors, became inaccessible. The BBC said it had not confirmed whether their outages were connected to the PHP vulnerabilities and had requested comment.
The Office for Budget Responsibility (OBR) also took its website offline, saying it had followed guidance because of the critical security issues affecting PHP.
Websites belonging to Edinburgh and Oxford councils were taken offline on Wednesday but have since become accessible again.
Elsewhere, the Dutch cybersecurity agency temporarily went offline as a precaution, Finland’s government shut down its public web services, and Wikipedia took parts of its website offline.
The measures followed warnings from authorities, including US agencies, that systems should be taken offline if the vulnerabilities could not be addressed immediately.
What happens next?
Cybersecurity agencies are urging organisations to identify affected systems, apply the necessary fixes and follow official guidance before restoring services.
The incident has highlighted the risks posed by vulnerabilities in widely used software, particularly when technical details become public before organisations have secured their systems.
It has also demonstrated how AI can assist researchers in identifying long-standing weaknesses — while potentially helping attackers exploit them more quickly.
With PHP embedded in a substantial part of the internet, authorities and technology companies face a race to limit the damage and prevent the vulnerabilities from being used to steal data, disrupt services or gain deeper access to computer networks.
