The key facts
- Vulnerabilities that existed for years found in PHP; no attacks recorded so far
- Cloudflare and Palo Alto Networks report millions of exploitation attempts
- A patch has been released, but it only works on the latest version of PHP — older websites need an update
'The cyber equivalent of an unexploded bomb'
BBC technology editor Zoe Kleinman compared the situation with vulnerabilities in the PHP programming language to an 'unexploded bomb': according to her, she has never seen such a dramatic, public and global response to a cyber event that has not yet happened. Attacks similar to the M&S and JLR hacks of 2025 have not yet occurred, but the potential threat is so serious that websites around the world are being taken offline as a precaution.
The essence of the problem
Vulnerabilities in PHP — the language on which millions of websites run — existed unnoticed for years, and exploiting them is not easy. One cybersecurity researcher told Kleinman that he spent all night trying to do so as an experiment, but without success. However, what is difficult for humans comes easier to AI: the technology has been credited with helping researchers find bugs, and the PHP Foundation, which oversees the language, promptly released a fix.
A leak and a race against time
The information was supposed to be kept secret until everyone had fixed their websites, but the news leaked — and from that moment 'the clock started ticking'. At the time of publication, there are no reports of successful attacks using these vulnerabilities. Professor Alan Woodward of the University of Surrey called this 'a real dilemma': how to warn defenders of the need to patch without warning the attackers.
Millions of attempts and the role of AI
Major web companies Cloudflare and Palo Alto Networks report millions of exploitation attempts. Whether any criminals will succeed is unknown — affected companies may not yet know it themselves. Professor Gina Neff of Queen Mary University of London called the situation 'good news': a team of people, with the support of a major AI company, used AI to find the problem, worked for months on fixing it and prepared everyone for defence. At the same time, she and Kleinman note that the same AI tools are available to malicious actors.
What website owners should do
Cyber authorities are urging website owners to fix the vulnerabilities immediately. However, the patch only works on the latest version of PHP, so older websites will first need an upgrade — for many, this could be a significant repair job. Kleinman also reminds readers: less than two months ago, 100 technology companies warned in an open letter of the need for a new level of cyber resilience in the AI era.
Image source, Getty Images Cyber-security flaws were recently identified in the popular PHP programming language, which is used on a vast number of websites across the world
