The key facts
- Critical vulnerabilities in PHP, named php2shell, allow remote code execution on servers under certain conditions
- In the UK, 32 government services are unavailable and 4 are partially unavailable; this is described as largely a precautionary measure
- Cloudflare recorded a rise in exploitation attempts from thousands to millions; no successful breaches have been reported so far
Global emergency patching
Organizations and companies around the world continue to urgently update their systems after the discovery of critical vulnerabilities in PHP — a widely used programming language for web development that has been in use for several decades. On Wednesday and Thursday, numerous websites around the world were temporarily taken offline after PHP developers reported 'critical vulnerabilities.' Researchers warned that the 'serious' vulnerabilities could leave millions of websites open to compromise if they are not patched. No successful attacks have been recorded so far, but experts note that the consequences may unfold over a long period — even months.
Outages in the UK government
Downing Street said on Thursday that 'some' limited government services 'may be unavailable' while security work is carried out. Technology minister Baroness Lloyd of Effra told the House of Lords that 32 government services are unavailable and four are partially unavailable. According to her, this was 'largely the result of precautionary measures' while updates are being installed. The government did not specify which services have been taken offline, but stated that the UK's major public critical services were not affected. A government spokesperson noted that work to identify and remediate potential vulnerabilities is already underway, and that experts 'continue to work closely with OpenAI and international partners.' He added that this 'does not mean they have been hacked.'
Expert reactions and examples of disruption
Ollie Whitehouse, Chief Technology Officer at the National Cyber Security Centre (NCSC), called the event 'unprecedented' and suggested that its consequences 'will be felt by everyone,' while noting the absence of signs of successful breaches. According to him, the NCSC is beginning to receive confirmation that guidance to affected parties has been received and is being followed. Cybersecurity lecturer Rory Hopcraft told the BBC that the government needs to keep its own infrastructure up to date, since it 'sets the rules for other organizations.' Dean Presley, the owner of a car repair shop in Chepstow (Wales), said he cannot fully process MOT tests online: his system has not worked since Wednesday; MOT tests can legally be carried out, but documents and certificates are not printing, which means everything has to be done on paper, delaying customers.
What PHP and the php2shell vulnerability are
PHP (PHP: Hypertext Preprocessor) is a programming language that runs on a web server and generates the pages a user sees. It was created in the early 1990s for dynamic web pages and still underpins many platforms, including Wikipedia, online stores and WordPress, as well as the frameworks Laravel, Symfony and Drupal. According to the company Wiz, which participated in discovering the vulnerabilities, PHP runs on roughly 70% of the world's websites. The vulnerability, named php2shell, is inherent to the language itself and affects many past versions. The PHP Foundation warned that under certain conditions an unauthenticated attacker could remotely execute code on servers running PHP. The vulnerability was discovered by researchers from Calif and Wiz, in part using OpenAI tools; the PHP Foundation had theorized its possibility back in 2024.
Rise in attack attempts and recovery progress
Cloudflare CEO Matthew Prince wrote on X that in the 10 hours before the public announcement the company recorded 'thousands' of attempts to exploit the vulnerability on its network, in the 45 minutes after the announcement — tens of thousands, within two hours — hundreds of thousands, and now — millions. Amazon also reported attempts by attackers to exploit the vulnerability, but its websites were operating normally. The website of the Dutch cyber security agency, the websites of the government of Finland and parts of Wikipedia, temporarily taken offline on Wednesday, had returned to normal operation by Thursday. The French telecommunications company Orange reported suspending access to some services worldwide while fixes are installed. According to researchers scanning vulnerable servers, organizations are installing patches, but not as quickly as would be desired. Matt Hull of NCC Group noted that 'the window for response has sharply narrowed': whereas it used to take weeks to exploit a vulnerability, it now takes days or hours. He also warned about the risk of burnout among specialists and urged people to 'take breaks, distribute the workload and look after each other,' emphasizing that resilience depends on people no less than on technology.
Image source, Getty Images Cyber researchers at Calif and Wiz unearthed the php2shell flaw, theorised by the PHP Foundation in 2024, in part using OpenAI tools
