Global websites scramble to patch serious PHP vulnerability
A newly disclosed flaw in the PHP programming language has prompted governments and businesses to take websites offline while they install fixes. The US National Security Agency warned that attackers could exploit the bug to seize servers, steal data or disrupt services. Cybersecurity firms reported many exploitation attempts, though researchers said widespread compromise had not yet been confirmed.
PHP runs roughly seven in ten websites, so the bug’s reach is unusually broad. The flaw surfaced on Wednesday, prompting agencies and firms to take sites offline while applying a fix; the BBC’s Traitors page was among those affected. Smaller bodies such as schools, councils and charities may struggle to patch quickly without dedicated security staff.
One security firm recorded exploit attempts rising from tens of thousands in 45 minutes to hundreds of thousands two hours later, then millions. Amazon Threat Intelligence said PHP2Shell was being actively used, while researcher Ryan Austin cautioned that evidence of broad compromise was still lacking. The fix appeared Wednesday, one day after the flaw became public.
The incident may affect anyone relying on websites for news, payments, or public services, because outages can interrupt access while patches are applied. Schools, local governments, and charities could face particular strain if they lack specialist staff, potentially leaving services exposed longer. For ordinary users, the main near-term risk may be disrupted access and possible data theft if vulnerable servers are compromised; however, confirmed widespread harm has not yet been established.