The key facts
- Two critical vulnerabilities found in PHP; the PHP Foundation patch was released at 15:00 BST on Wednesday
- National cyber agencies urged urgent updates or taking websites offline
- Rumors of mass attacks were partly unconfirmed; experts warn of “alert fatigue”
Emergency response around the world
Two critical vulnerabilities in the PHP programming language, which powers millions of websites, triggered a global emergency response: national cyber agencies urged IT teams to urgently install the patch or take websites and servers offline. Microsoft chief Satya Nadella said at a conference that he had not seen anything like it “in a very, very long time,” noting that for IT and security professionals it was “a long day and a long night.”
Stories from the front line
British system administrator Adam Mudd told the BBC that “it was endless”: he had never received so many messages from worried website owners. He said the hardest part was combining clients’ requests to take sites offline as a precaution with coordinating updates — “sometimes taking a site down takes longer than fixing the PHP issue.” He worked from early morning until 22:30 BST. In Mauritius, administrator Loganaden Velvindron said that many PHP versions in use are no longer supported, and the team has to rebuild web applications and change code; he added that the vulnerability announcement came as a surprise with no time to prepare. John Jones, chief technology officer at an advertising company, called the situation “eye-opening,” but partly “exciting, like a scene from a Hollywood action movie.” The PHP Foundation patch was released at 15:00 BST on Wednesday, and, according to Jones, “the race began,” although updates always carry the risk of new problems.
Disinformation and rumors of attacks
The rush was linked to the fact that details of the vulnerability leaked early, and there were persistent rumors that criminals were already attacking. However, experts doubt the reliability of these rumors. British cyber expert Daniel Card said he was “flooded with garbage intelligence about hackers with working Proof of Concept methods,” and called the situation unprecedented in scale. He agrees that the vulnerabilities are very serious on paper, but he and others are frustrated by the disinformation about “hackers on the loose.” One major cyber company issued a warning about a working PoC that then had to be withdrawn. Despite statements from Cloudflare and AWS about “millions of hacking attempts every hour,” there is no evidence of large-scale data leaks or successful attacks. Hackers did indeed try to use AI to create attack methods, but, according to the BBC, none of them works at scale yet.
The role of AI and “alert fatigue”
The PHP vulnerabilities themselves, hidden from researchers for decades, were found with the help of AI. All the IT professionals interviewed agreed that serious defects like these will be discovered more often, since AI tools have become effective at breaking things. Wordfence founder Mark Maunder wrote that as OpenAI and Anthropic’s capabilities grow, “scary vulnerabilities” will be found, but “the tone of messaging needs to be calibrated”: there is a risk of “alert fatigue,” which will become a big problem if a truly fully exploitable serious vulnerability appears.
