Millions of exploit attempts hit PHP flaw affecting 70% of websites
Governments pulled sites offline to patch a critical PHP flaw. Researchers say frontier AI helped turn a decades-old bug into an exploit.
The story in focus
A critical vulnerability in PHP, the language underpinning about 70% of websites, drew millions of exploitation attempts after disclosure, cybersecurity firms said. Governments and companies took sites offline to patch. The US warned attackers could seize web servers, steal data and disrupt services. Researchers said frontier AI helped demonstrate exploitability.
- CloudFlare reported attempts rising from tens of thousands in 45 minutes to millions within hours of the announcement
- The UK took 32 government services offline as a precaution and its NCSC sent 50,000 alerts, reporting no successful hacks
- Wiz said the flaws were decades old but demonstrating exploitability required an exceptionally complex chain of steps
What happened
The PHP2Shell vulnerability in the PHP programming language emerged on Wednesday, prompting governments and companies to pull websites offline so they could patch the fault. The PHP Foundation said on Wednesday it had released fixes and update instructions. The US National Security Agency warned the flaw could let attackers take control of web servers, steal sensitive data, disrupt services and move deeper into networks.
CloudFlare chief executive Matthew Prince said the company saw tens of thousands of exploitation attempts in the 45 minutes after the problem was announced, rising to hundreds of thousands within two hours and millions by Thursday. Amazon Threat Intelligence said the vulnerability was being broadly exploited in the wild. Calif researcher Ryan Austin, key to discovering the flaw, said exploitation did not yet appear to have taken off or been widespread.
Who is affected
In the UK, cybersecurity minister Liz Lloyd told parliament that 32 government services had been taken offline, largely as precautionary measures. Downing Street said no public-facing critical services were affected. The BBC's Traitors website was down on Thursday; the Internet Archive, Wikipedia and 4Chan were reportedly temporarily affected. The NCSC said the scale was unprecedented and the patch would not work for some organisations on older systems, which would need replacing.
Concern focused on schools, local governments and charities that may lack dedicated cybersecurity support. South Korea activated emergency response measures and raised its private sector alert level. China's industry ministry urged immediate inspection and upgrades, and Japan's prime minister encouraged patching or shutting down sites. The FBI urged organisations unable to patch immediately to take sites offline temporarily.
The AI angle
Wiz, one of the research organisations that uncovered the vulnerabilities, said the underlying flaws had been present for decades but demonstrating exploitability required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. It said frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
Prof Alan Woodward said the flaw was revealed a day before the patch was released, and that somebody let the cat out of the bag. Ciaran Martin, former NCSC chief executive, called it the most serious vulnerability discovered for five years. Consumers' stored data could be at risk on unpatched sites, though visiting a vulnerable site does not necessarily compromise a device, according to security head Voldemaras Kadys.
Do I need to stop using websites because of the PHP flaw?
Security experts quoted by CBS News say there is no reason to stop browsing or shopping online, but users should be extra cautious about suspicious messages because it is unclear what data may have been stolen and from which sites.
Sources & further reading
- Websites across world hit by millions of attempts to exploit PHP code flaw ↗The Guardian
- What to know about the PHP bug affecting 70% of world's websites ↗CBS News
Help keep the record accurate. Send a correction.
