Dozens of websites still offline as agencies race to patch PHP flaw

A critical vulnerability in PHP, a programming language used across a large part of the internet, has forced governments and organisations around the world to take websites offline while they apply fixes. The latest reports say dozens of sites remain offline, but the outages are largely precautionary rather than the result of a successful cyber attack.

PHP is an older but deeply embedded language that runs behind the scenes on web servers. It helps generate pages, process forms and move data between websites and databases. Estimates of its reach vary, with some experts saying it is used in about 45% of websites and others putting the figure at around 70%. Security firm Wiz has estimated that roughly 70% of the internet is affected by the flaws.

The problem centres on two serious vulnerabilities in PHP. Researchers found that, if left unpatched, attackers could run their own commands on vulnerable servers without authentication. In effect, they could take control of a website and potentially reach data stored behind it, including personal or financial information. The vulnerabilities had existed for years without a practical exploit being known. A theoretical flaw was identified in 2024, but it took AI tools to work out how it could actually be used.

Researchers working with OpenAI and cyber security firms, including Wiz, used AI to find the exploit path and another serious flaw. A patch was prepared for release, but details leaked before many organisations were ready. Reports suggest a video of how the hack could work circulated online, prompting a rush to patch or shut down exposed systems. Fixes have been issued for newer versions of PHP, including versions 8.2 to 8.5, but older versions may need to be upgraded first and some abandoned sites may never be fixed.

In the UK, the government said 32 services were unavailable and four were partially unavailable, mostly because of precautionary measures. Downing Street said no large public-facing critical services had been affected. Among the services disrupted were Ministry of Justice systems, the power of attorney service, civil service jobs sites, council websites and the MOT portal. Some MOT testing had to be recorded on paper while systems were unavailable. The Office for Budget Responsibility website, parts of the BBC website, Wikipedia and WordPress also reported issues, along with sites in countries including Finland, the Netherlands, France, Germany, Australia, Belgium and Japan.

The National Cyber Security Centre advised organisations to install the patch quickly or take systems offline if they could not. It sent about 50,000 warnings to UK organisations. The US National Security Agency also urged affected organisations, potentially covering up to 30 million websites, to take systems offline while fixes were applied. Cloudflare said attempted exploits rose from thousands before public disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions afterwards. Amazon said it had detected attempts to exploit the flaws, but there has been no confirmed successful breach of central government systems.

Experts say individual internet users can do little beyond relying on website operators to patch their systems. The incident has also highlighted the dual role of AI in cyber security. AI helped defenders find flaws that humans had missed, but the same tools can help attackers reverse-engineer exploits and scan for vulnerable sites. With many old and unmaintained websites still running outdated versions of PHP, officials expect further disruption and attempted attacks in the coming days.