The key facts
- Two critical vulnerabilities in PHP, hidden for decades, found with the help of AI; the PHP Foundation patch was released on Wednesday at 15:00 BST
- Satya Nadella: had not seen anything like it 'in a long, long time'; IT professionals are working around the clock, with some sites taken offline as a precaution
- Cloudflare and AWS reported 'millions of hacking attempts' per hour, but there is no evidence of large-scale attacks or data leaks; one major cyber firm retracted its warning about a working PoC
Global emergency work by IT professionals
Administrators around the world have spent several days straight urgently patching critical vulnerabilities in PHP — the programming language that powers millions of websites. Adam Mudd, a system administrator from the UK, told the BBC that 'it was an endless marathon': he had never received so many messages from alarmed website owners. According to him, the main difficulty is balancing clients' requests to take sites offline as a precaution with coordinating updates across many different configurations; sometimes taking a site offline takes longer than the fix itself. He worked from early morning until 22:30 UK time and lost a significant amount of sleep.
A surprise with no time to prepare
In Mauritius, IT administrator Loganaden Velvindron said his team was overwhelmed with work when it realized how broad the dependence on PHP is: many versions in use are no longer supported, forcing them to rebuild web applications and change code. He noted that the announcement of the vulnerabilities came as a surprise and left no time to prepare. John Jones, chief technology officer at a digital advertising company, called the warning 'a revelation' and a new experience that nevertheless felt 'like a scene from a Hollywood action movie.' The patch from the PHP Foundation, which oversees the language, was released on Wednesday at 15:00 BST, and Jones described the ensuing 'race,' adding that updates always carry the risk of new problems.
Panic, disinformation and conflicting data
The frenzy was amplified by an early leak of the vulnerability details and active rumors that criminals were already attacking. British expert Daniel Card said he was 'flooded with junk data' about hackers with working proof-of-concept methods; in his words, the situation is 'in a different dimension' compared with previous ones. He and other experts acknowledge the severity of the vulnerabilities on paper but are irritated by the disinformation. One major cyber company issued a warning about a working PoC and then retracted it. Despite statements from Cloudflare and AWS about 'millions of hacking attempts' every hour, there is no evidence of large-scale attacks or data leaks. Hackers have indeed tried to use AI to create attack methods, but none of them works at scale yet — although that could soon change.
Government response and fears of 'alert fatigue'
Microsoft chief Satya Nadella said at a conference that he had not seen a PHP emergency like this 'in a long, long time,' noting 'a long day and a long night' for IT and security professionals. Alerts were issued by state cyber agencies, up to the Prime Minister of Japan. The vulnerabilities themselves, hidden from researchers for decades, were found with the help of AI. IT workers surveyed agree that serious defects like these will be discovered more and more often as AI tools improve. Mark Maunder, founder of Wordfence, a security tool for WordPress, wrote that as the capabilities of OpenAI and Anthropic grow, 'frightening vulnerabilities' will be found, but he urged 'calibrating the tone of messaging': there is a risk of 'alert fatigue,' which will become a big problem if a fully exploitable serious vulnerability appears.
