AI Uncovers Decade-Old Flaws in PHP, Triggering Global Website Shutdowns
Critical vulnerabilities in core web language prompt emergency fixes and warnings from cybersecurity agencies worldwide.
Sarah Connor
Serious flaws in the PHP programming language, undetected for over a decade, have been exposed.
The US National Security Agency's cyber division warned that weaknesses in the software could provide a direct path to a server's file system or database. US President Donald Trump announced his administration coordinates with federal agencies to expedite fixes.
The Finnish government's website, Oxford City Council, Edinburgh City Council, and the Office for Budget Responsibility all took their websites offline. The Wikimedia Foundation also took down some systems as a precaution, affecting access to parts of Wikipedia.
Details of the flaw leaked on social media on Tuesday, intensifying the global response. Cloudflare reported millions of hacking attempts since the exploits were shared.
Matthew Prince from Cloudflare stated, "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Amazon faced multiple targeting attempts before an embargo on the warning lifted. Salil Kanhere claims more attempts to exploit these flaws are likely in the coming weeks, now that the technical details are public.
Paul Spain claims the flaw could affect millions of websites. Wiz, a security firm owned by Alphabet's Google, found the flaws independently and reported a second one on August 24.
A Government spokesperson confirmed that "Work is already under way across Government to actively identify and patch any potential exposure. We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."
Work is already under way across Government to actively identify and patch any potential exposure.
The UK government confirmed 32 government services are offline and four are partially unavailable due to the flaw. Japan's prime minister encouraged businesses to patch the vulnerability or shut down their sites.
A 2025 review by the UK government found about 28% of central government technology classified as 'legacy' or out of date. Some of the Government’s online services may be temporarily unavailable while steps are taken to maintain security.
No large public-facing critical services are thought to have been affected.