Governments Pull Websites Offline After Serious Flaw Found in Web Language PHP

Governments and companies around the world took websites offline this week after the disclosure of a serious security flaw in PHP, the programming language that underpins roughly 70 percent of the world’s websites, and security firms reported a fast-growing wave of attempts to exploit it.

The weakness came to light on Wednesday, and PHP’s developers released fixes the same day. The National Security Agency said such flaws often give attackers a direct path to a server’s files or database, urged organizations that could not patch right away to take their websites offline, and asked those that use PHP to stay on heightened alert in the coming weeks.

Matthew Prince, the chief executive of the internet security company Cloudflare, said his firm saw tens of thousands of attempts to exploit the flaw in the first 45 minutes after it was announced. By Thursday, he said, the number had grown into the millions. Amazon’s threat intelligence team said the vulnerability, which researchers have nicknamed PHP2Shell, was being broadly exploited and that several groups had probed it before the fix was released.

Many organizations responded by simply unplugging. In Britain, the technology minister told the House of Lords that 32 government services were unavailable and four more partly unavailable while updates were installed, and The Guardian reported that the National Cyber Security Centre had sent about 50,000 alerts to affected organizations. Government services in Finland and many local government sites in France were also briefly taken down, and China’s industry ministry urged organizations to check for gaps. The Guardian also reported that the Internet Archive and Wikipedia were temporarily affected.

Officials in Britain called the scale of the problem unprecedented. Ciaran Martin, a former head of the country’s cyber agency, described it as the most serious vulnerability found in five years. Security researchers say the flaws had been present in PHP for many years before they were found.

There are reasons for caution about the worst fears. The British cyber agency had no reports of successful hacks, according to The Guardian, and a researcher involved in finding the flaw said exploitation did not yet appear to have taken off on a wide scale. Many of the government sites that went dark came back online within hours once patches were applied.

The greater worry is for organizations without dedicated security staff. Schools, local governments and charities often run older systems, and Britain’s cyber agency urged anyone running an older version of PHP to move to a fully supported one. Experts also questioned how the disclosure was handled: Cloudflare said it saw thousands of exploitation attempts in the hours before the flaw was publicly announced, and one British academic said details appear to have leaked a day before the fix was ready.

For ordinary internet users there is little to do but wait. The risk sits with the companies and agencies that run websites, and security officials say the most important step is for those operators to install the updated version of PHP as quickly as possible.