Websites around the world are under attack. Cybersecurity firms say they have seen millions of attempts to exploit PHP2Shell, a newly discovered flaw in the PHP programming language. The US National Security Agency warned it could let attackers take control of web servers, steal data and disrupt services.
PHP underpins about 70% of the world’s websites. The flaw emerged on Wednesday, and governments and companies pulled sites offline before attackers could reach them. Many were patched and returned to service soon afterwards.
Governments Scramble to Patch
In the UK, 32 government services went offline. Cybersecurity minister Liz Lloyd told parliament the shutdowns “largely resulted from precautionary measures.” Downing Street said no public-facing critical services were affected. The BBC’s Traitors website was among the sites that went down. Wikipedia, the Internet Archive and 4Chan were also reportedly affected for a time.
The National Cyber Security Centre sent 50,000 alerts to organisations. It called the scale of the flaw “unprecedented” and said it had no reports of successful hacks. The patch will not work on older systems, which will have to be replaced. Schools, local councils and charities are a particular worry, because many lack dedicated security staff.
Other governments moved quickly too. South Korea activated emergency response measures and raised its private-sector alert level. China’s industry ministry urged organisations to inspect their systems and upgrade PHP. Japan’s prime minister told businesses to patch the flaw or shut their sites down.
How Bad Is It?
Ciaran Martin, former chief executive of the NCSC, called it “the most serious vulnerability discovered for five years.” Former GCHQ chief David Omand warned that Russia and China could try to exploit it.
The NSA said cyber-actors are “likely to weaponise PHP2Shell” and ordered immediate patching across US government agencies.
The attack figures are rising fast. Cloudflare CEO Matthew Prince said the company saw tens of thousands of attempts within 45 minutes of the announcement. That grew to hundreds of thousands within two hours, “and millions now.” Amazon Threat Intelligence said PHP2Shell is “now being broadly exploited in the wild.”
Not everyone sees widespread damage yet. Ryan Austin of Calif, who helped find the flaw, said exploitation “doesn’t look like it has taken off or been widespread.” The British Chambers of Commerce said firms had reported no significant difficulties.
A Leak Before the Patch?
Cloudflare saw thousands of exploitation attempts in the 10 hours before the flaw was public. Professor Alan Woodward said the flaw was revealed a day before the patch was released and that “somebody let the cat out of the bag.”
Security expert Michał Woźniak said attackers could hijack exposed sites’ computing power and IP addresses. Criminal groups or state-sponsored hackers could use them to launch untraceable attacks. Crypto miners could use the servers for free. Many sites would never know.
Wiz, one of the firms that uncovered the flaw, said it is arguably among the most severe software vulnerabilities ever found. The underlying flaws had existed for decades. Exploiting them took an exceptionally complex chain of steps, but “frontier AI models substantially reduced that barrier.”
Stay informed. Subscribe to the JournalTodays Newsletter for the latest cybersecurity news, technology coverage, and online safety updates delivered straight to your inbox.
