News
Millions of attacks follow PHP flaw as ministers pull services offline
— 3 mins read
A flaw that went unnoticed in the code behind most of the web for more than ten years was found by a machine, and now every website owner has to catch up.
Thirty-two government services are offline and four more are partly unavailable. The cause is a critical flaw in PHP, the software behind most of the world’s websites, and it has set off a wave of precautionary shutdowns across Whitehall.
The figure came from the technology minister, Baroness Lloyd of Effra. On Thursday she told the House of Lords that the outages were largely precautionary while security updates are applied. Downing Street said no large public-facing critical services were affected, and that the closures did “not mean they were hacked”. It would not say which services had gone dark, because publishing a list is not “standard practice”.
The Office for Budget Responsibility took its own website down. The Budget is due next week, and the Scottish Secretary, Douglas Alexander, told Times Radio he had “no indication whatsoever” of any breach of Budget security.
The Budget is due next week, and the Scottish Secretary, Douglas Alexander, told Times Radio he had “no indication whatsoever” of any breach of Budget security.
What went wrong
There are two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and known together as PHP2Shell. Either one lets an attacker take control of a web server without logging in. Both are rated 9.2 out of 10 for severity, and they reach back to PHP 5, first released in 2004.
PHP runs about three-quarters of the websites whose underlying language can be identified, according to W3Techs. That covers sites built on WordPress, Drupal, Joomla and Magento. The flaw sits in PHP itself rather than in any one platform, so the exposure is very wide.
Found by a machine
How the hole was found will matter longer than this week’s outages. The security firms Calif and Wiz used AI models from OpenAI and Google to identify and verify the flaws, then worked with PHP’s developers before going public. Alan Woodward, visiting professor at the University of Surrey, said human researchers had spotted the issue in 2024 but judged it too complicated to exploit. Wiz put the change bluntly: “With AI, this is no longer a barrier.”
The race since
The release was meant to be orderly. It was not. Details leaked, and PHP’s developers pushed out fixes on Wednesday afternoon, earlier than planned. Amazon says someone tried the exploit against one of its decoy servers on 17 October, four days before the public was told. Cloudflare’s chief executive, Matthew Prince, reported tens of thousands of attempts within 45 minutes of the announcement, hundreds of thousands within two hours, and millions since. So far there is no evidence that any of them succeeded.
The National Cyber Security Centre calls the scale “unprecedented” but says there is no sign of breaches yet. Its chief technology officer, Ollie Whitehouse, says the problem will be “universally felt”. OpenAI briefed the NCSC last week, and Baroness Lloyd said the government “acted proactively ahead of public disclosure”.
Other countries have gone further. In the Netherlands, the national cyber agency took its own site offline, along with the Port of Rotterdam and several hospitals. Finland suspended its government’s public web services. Wikipedia pulled supporting systems while they were patched. In the UK, Edinburgh Council’s website and several BBC programme pages also went down, though neither has confirmed a link to the flaw.
In the Netherlands, the national cyber agency took its own site offline, along with the Port of Rotterdam and several hospitals.
What to do
The NCSC’s advice is to update PHP to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12), or to take a site offline until it can be fixed. The official patches cover only PHP 8.2 and newer. Older installations need a fix from their software vendor, or an upgrade. Amazon advises organisations to check for suspicious activity going back to 17 October rather than assume they were safe until this week.
For small businesses, the first step is simple: ask your web host which version of PHP your site runs and whether it has been patched. Do not assume it has.
The fix exists. What nobody knows yet is how many of the web’s millions of small, half-forgotten sites will ever get it.
