Across a single week in October, a quiet assumption of the modern age was briefly exposed: that the invisible machinery beneath our screens will hold. Flaws in PHP, a language that quietly assembles pages for roughly seven in ten websites, forced many sites and governments to step back from the network while the work of repair proceeded. In Britain, dozens of public services went dark as a precaution, touching ordinary lives in places like a village garage in South Wales, where paperwork returned to the pen. No breaches have been confirmed, yet the episode reminds us how much of daily life res
Race to Patch PHP Flaw as Websites Go Dark and UK Government Services Are Taken Offline
A garage owner in Chepstow, South Wales, was unable to process MOT certificates and records online, causing customer delays.
Millions of attempts, and no confirmed breach yet
Mark
Why is this one different from the usual security alert?
Mimi
Scale. Wiz says PHP powers 70% of the world's websites, and the flaw sits in the language itself, across many past versions. The NCSC's Olly Whitehouse called it unprecedented.
Luke
Worth noting that 70% is Wiz's figure, one firm's estimate, though it helped find the flaws.
Mark
What could an attacker actually do?
Mimi
The PHP Foundation says that under the right conditions, an unauthenticated attacker could remotely execute code on a server running PHP.
Luke
"Under the right conditions" matters. The reporting doesn't say how many servers meet them.
Mark
And the government's position?
Mimi
32 services unavailable, four partly, mostly precautionary. Officials say that doesn't mean they were hacked.
Luke
We don't know which services. That's unspecified, so the claim that no large critical services were hit can't be checked from here.
Mark
Cloudflare saw millions of attempts. Does that mean breaches?
Mimi
Not necessarily. Attempts aren't successes, and the NCSC says it sees no indications of successful breaches.
Luke
Right, and Prince's numbers are Cloudflare's own view of its network. Experts also say damage could take months to show, so absence of evidence today is not a clean bill of health.
Mark
What's the human side?
Mimi
Dean Presley's garage in Chepstow is on paper, and security staff face burnout, as Matt Hull warned.
Il Polso
- Critical PHP flaws allowing unauthenticated remote code execution have left servers worldwide exposed and racing against attackers.
- Websites went offline on Wednesday and Thursday as operators scrambled to check whether PHP was running in their systems.
- The UK government took 32 services offline and four partially, while officials insist no critical public-facing service was hit.
- Attack attempts climbed from thousands to millions within days, and attackers now strike in hours rather than weeks.
- Patching is underway but lagging, and experts warn the true impact may take months to surface as exhausted defenders keep working.
Across a single week in October, a quiet assumption of the modern age was briefly exposed: that the invisible machinery beneath our screens will hold. Flaws in PHP, a language that quietly assembles pages for roughly seven in ten websites, forced many sites and governments to step back from the network while the work of repair proceeded. In Britain, dozens of public services went dark as a precaution, touching ordinary lives in places like a village garage in South Wales, where paperwork returned to the pen. No breaches have been confirmed, yet the episode reminds us how much of daily life rests on shared foundations that few ever see, and how patiently they must be tended.
At a garage in Chepstow, South Wales, Dean Presley's computer system went down on Wednesday morning and had not returned by Thursday. MOT tests could still be carried out legally, but the certificates could not be printed and the results would not show on screen. So he wrote everything out by hand, and his customers waited longer for it.
His small disruption was part of a far larger one. The developers of PHP, the back-end language that works unseen on a web server to turn data into the pages we read, announced critical vulnerabilities, and websites around the world were pulled offline. The flaws, named php2shell by the security firm Wiz, are built into the language itself and affect many past versions. Unpatched servers could be hacked remotely, and millions of sites were at risk.
The UK government took 32 services offline and four partially, mostly as a precaution during security work. Officials said no large public-facing critical services had been hit and that there was no sign of a breach. The National Cyber Security Centre called the event unprecedented and said its advice was being acted on.
The pressure on defenders has been intense. Cloudflare saw attack attempts rise from thousands to millions in a matter of hours. Some sites came back by Thursday, others stayed dark while operators checked their systems, and patching is moving more slowly than hoped. Security professionals are already tiring, and experts warn that the full consequences may not be clear for months.
At a garage in Chepstow, South Wales, Dean Presley's computer system went down on Wednesday morning and had not come back by Thursday. He told BBC Your Voice that MOT tests can still be carried out legally, but the paperwork and certificates cannot be printed and the results are not showing on the system. So he has been writing everything out on paper, and his customers have been waiting longer as a result.
His outage is one small piece of a much larger disruption. Websites around the world were pulled offline on Wednesday and Thursday after the developers of PHP, the back-end programming language, announced "critical vulnerabilities". Researchers described the flaws as severe and warned that millions of sites could be exposed to hacking if they were left unpatched.
PHP has been around since the early 1990s. It runs on a web server, behind the scenes, collecting data and turning it into the page a visitor sees. It has been used across Wikipedia, online shops and WordPress, and frameworks such as Laravel, Symfony and Drupal are built on it. The cyber-security firm Wiz, which helped uncover the flaws, says PHP powers 70% of the world's websites. Wiz has named the vulnerabilities "php2shell" and says they are inherent in the language itself, affecting many past versions. The PHP Foundation, the non-profit that maintains the language, warned that under the right conditions an unauthenticated attacker could remotely execute code on servers running PHP.
The UK government was among those that took systems offline as a precaution. Downing Street said on Thursday that "some" limited services might be unavailable while security work was carried out. Tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four were partially unavailable. She said this largely resulted from precautionary measures taken while security updates and mitigations were applied. The government did not say which services were affected, but said no large public-facing critical services had been hit. A spokesperson said work had taken place across government to identify and fix potential exposures, with experts working closely with OpenAI and international partners. "But this does not mean they were hacked," the spokesperson added.
Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event "unprecedented" and told Radio 4's World At One that he suspected it would be "universally felt". He said there were no indications of successful breaches, and that the NCSC was starting to see positive confirmation that its advice to affected organisations had been received and acted on. Rory Hopcraft, a cyber-security lecturer, said the government sets the rules for other organisations and now needs to practise what it preaches by keeping its own infrastructure up to date.
The attempts to exploit the flaws have been heavy. Matthew Prince, the boss of Cloudflare, wrote on X that the company saw thousands of attempts across its network in the 10 hours before the public announcement. That rose to tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, and millions by Thursday. Amazon also said it had seen exploitation attempts, though its websites kept operating normally.
Some sites that went dark on Wednesday were back by Thursday, including a Dutch cyber-security agency, the Finnish government and parts of Wikipedia. Others appeared to go offline on Thursday as operators checked whether PHP was running in their systems. In France, Orange said it had suspended access to certain services globally while it deployed fixes. Scans by some researchers suggest patching is under way but not as quickly as hoped.
Matt Hull of NCC Group said the time to respond has shrunk: where attackers once took weeks to exploit a flaw, it can now take days or hours. He also pointed to the toll on the people doing the work, saying that several days in, security professionals may already be burning out, and urged them to rest and share the load. No successful attacks have been reported so far, but experts say the full impact could take months to become clear.
Citazioni salienti
The information I have is that 32 Government services are unavailable and four are partially unavailable.— Baroness Lloyd of Effra, tech minister, to the House of Lords
A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours.— Matt Hull, NCC Group
Vuoi la storia completa?
Leggi l'originale su BBC News ↗
Politics & Governance