Cover image: Rows of server racks inside a data centre computer server room — NOIRLab/NSF/AURA/T. Slovinský, Wikimedia Commons, CC BY 4.0.
The emergency has shifted. A day after governments across Europe took websites offline in a dramatic precaution against two critical flaws in the PHP programming language, the focus has moved from shutting things down to figuring out what, exactly, is exposed — and who was already knocking on the door.
The UK government said on Thursday that it is "working to actively identify and patch any potential exposure in its online services" after the vulnerabilities were discovered in PHP, the server-side language that underpins a vast share of the world's websites — close to 70 per cent, according to cyber-security firm Cloudflare. Downing Street sought to calm nerves, saying that "no large public-facing critical services are being affected", while acknowledging that some limited services could be temporarily offline as fixes are rolled out.
It is the second act of a crisis that began when the flaws — rated 9.2 out of 10 on the CVSS severity scale and first uncovered with the help of artificial intelligence — forced an extraordinary response. As our coverage of yesterday's shutdowns reported, governments across Europe, including 32 UK government services, pulled sites offline as a precaution ahead of emergency patches released on Wednesday. Now comes the harder, quieter work: finding every vulnerable system and making sure nobody got in before the alarm sounded.
The hunt for exposure
A UK government spokesperson urged every organisation — private and public, large and small — to follow official guidance to protect their systems. The National Cyber Security Centre, alongside its counterparts in the EU and Australia, has told PHP users to apply the fixes without delay. Where immediate patching is not possible, the NCSC's guidance is blunt: organisations should consider taking affected systems offline until they can be fully secured.
That advice reflects the particular nastiness of the flaws, which the security community has nicknamed "PHP2Shell". The vulnerabilities could allow attackers — including, experts warn, foreign state actors — to remotely control web servers running PHP, potentially exposing passwords, tokens and other secrets held in memory. The NCSC has specifically warned that the problem extends beyond standalone PHP installations, since many software products bundle PHP inside them — so organisations must hunt for embedded copies, not just check directly managed web servers.
The guidance, published on the National Cyber Security Centre's website, also tells administrators to prioritise systems directly accessible from the internet and to examine logs for signs of compromise — an acknowledgment that some attackers may have moved before defenders did.
Amazon's early attackers
That possibility is no longer theoretical. Amazon disclosed on Wednesday that it had identified a "PHP2Shell exploitation attempt" as early as 17 October — before an embargo on the security warning was lifted and days before the flaws became public. The attempt, aimed at one of Amazon's decoy "honeypot" systems, was made from an anonymous internet address, which the company's security chief, CJ Moses, said indicated the activity of a genuine threat actor.
How the attackers learned of the flaws remains a mystery — one that has unsettled the security community, since the PHP Foundation had intended to release its discovery later this month alongside a complete fix. Instead, details of the flaw leaked on social media on Tuesday, forcing the timeline forward. Amazon detected further attacks on 21 October, and Moses said the variation in payloads and anonymisation methods pointed to multiple actors being involved.
A server room with computer terminals and networking equipment.
Servers like these run the web's PHP infrastructure. Credit: Jon Parise, Wikimedia Commons (CC BY-SA 2.0).
A flaw hiding in plain sight
The PHP Foundation, which maintains the language, has acknowledged that this crisis was years in the making. In a blog post reported by detailed coverage of the disclosure, the foundation said indications of one of the vulnerabilities had first emerged in 2024, when a security researcher flagged concerns about the language. The potential weakness was recognised at the time but never yielded a demonstrable exploitation method, and other concrete issues with clearer impact took priority — a delay the foundation has now conceded represented a structural failure in its security processes.
That admission raises uncomfortable questions about how open-source software projects assess emerging risks, particularly when researchers spot theoretical weaknesses long before anyone demonstrates how to exploit them. PHP is not a niche tool: it powers everything from personal blogs to government portals, e-commerce giants and sites like Wikipedia. When the foundation finally moved, the discovery of a working exploit — reportedly with AI assistance — turned a long-dormant theoretical concern into a live, critical emergency within days.
A world holding its breath
The global response has been sweeping. The Dutch cyber-security agency took systems offline as a precaution; Finland shut down public web services; Wikipedia took down parts of its site in line with advice from the US and other authorities. In the UK, council websites — including Oxford, Bristol, Lambeth and Barnet — were among those taken down on Wednesday, and some BBC webpages were temporarily unavailable.
Cyber-security expert Alp Toker, director at NetBlocks, told Sky News the flaw is highly impactful and warned the disruption could become more widespread — a prediction that will be tested in the coming days as attackers who downloaded the leaked details probe for unpatched servers. Security firm Cloudflare, which reported seeing millions of hacking attempts after the vulnerability was exposed, has not said whether any succeeded.
There is some reassurance. Australia's cyber-security centre said it was not aware of active exploitation, and the US cyber agency CISA said it had not observed exploitation as of the time of its advisory's publication, while stressing the flaws pose a risk to organisations left unpatched. But the gap between "not observed" and "not happening" is exactly what the UK's exposure-mapping effort is designed to close.
What happens next
The immediate task is patching — and it is enormous. Every organisation that runs PHP, or runs software that bundles it, must update to the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NCSC's advice is to identify every installation, starting with internet-facing systems, and to treat any system that cannot be patched promptly as a candidate for going offline.
Then comes the forensics: checking logs for the tell-tale signs of PHP2Shell probing, particularly around 17 and 21 October, when Amazon recorded its attacks. And finally, the policy reckoning — about embargoes that leak, about vulnerabilities left unaddressed since 2024, and about an internet that still leans on a handful of open-source projects maintained by small teams. Yesterday's coverage of the shutdowns made clear the drama of this week was a precaution. The real test is what the exposure-mapping finds — and whether the attackers who struck before the warning left anything behind.
For more on the week in technology, see our report on the ASOS customer data breach and the debate over AI chatbots and teen safety. The homepage carries the latest, and our about page explains how we work.
