Millions of exploit attempts target PHP flaw as governments patch systems

Liz Lloyd said 32 UK government services went offline

A vulnerability in PHP, the programming language that underpins about 70% of the world’s websites, prompted governments and companies around the world to take sites offline while they patched the fault. The problem surfaced on Wednesday, and PHP developers released a fix that day. The preemptive shutdowns were intended to keep attackers from reaching exposed systems.

In the UK, Liz Lloyd, the cybersecurity minister, told parliament that 32 government services had been taken offline. She said this “largely resulted from precautionary measures” while updates were applied. Downing Street said no public-facing critical services had been affected and that “some limited services may be temporarily offline,” adding that an outage did not mean a system had been hacked. The BBC’s Traitors website was among those down Thursday. The disruption also drew concern about schools, local governments and charities that may not have dedicated cybersecurity support to apply the fix.

Ciaran Martin, former chief executive of the UK’s National Cyber Security Centre, described the flaw as “very bad.” He said that while most internet software vulnerabilities did not matter, this was “the most serious vulnerability discovered for five years.” Calif researcher Ryan Austin, who was key to discovering the flaw, offered a more cautious assessment. “At the moment it doesn’t look like exploitation has taken off or been widespread,” Austin said.

Matthew Prince, chief executive of Cloudflare, said the company saw tens of thousands of attempts in the 45 minutes after the problem was announced. The number rose to “hundreds of thousands within two hours, and millions now,” he said. Cloudflare also reported thousands of attempts during the 10 hours before the flaw was publicly announced.

Amazon Threat Intelligence said PHP2Shell was “now being broadly exploited in the wild.” The company identified several attempts by multiple actors to test ways to capitalize on the vulnerability before PHP developers released the fix Wednesday.

The US National Security Agency said “cyber-actors are likely to weaponise PHP2Shell” and that the risks required immediate patching across US government departments and agencies. It warned that attackers who succeeded could seize web servers, steal sensitive data, disrupt services and move deeper into a network. US government websites were quickly taken offline so the patch could be installed, and many returned online soon afterward.

Internet infrastructure expert Michał Woźniak said the vulnerability could let hostile actors “grab the resources” of exposed sites. Woźniak said a website such as Slack or Wikipedia has access to computing power, servers and IP addresses, with the IP addresses locating the site on the internet. He said that in many cases PHP manages and mediates that infrastructure.

Woźniak said criminal groups, state-sponsored hackers or crypto miners might “nest” themselves in exposed sites through the vulnerability and then exploit those resources for their own aims. He said a hacking group could use an exposed site’s IP address to launch attacks that could not then be traced back to that site. He said crypto miners could use a server’s computing power to run their energy-intensive calculations for free. He said it was unclear at what scale this had been done and that many sites would not even be aware of it.

The handling of the alert was also questioned. Prof Alan Woodward said the flaw had been revealed a day before the patch was released and that “somebody let the cat out of the bag.”

Wiz, one of the research organizations that uncovered the vulnerabilities, called PHP2Shell arguably among the most severe software flaws ever discovered. The company said the underlying flaws had been present for decades, but demonstrating their exploitability required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” “Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz said.

South Korea’s government said on Thursday it was activating emergency response measures, raising its private-sector cybersecurity alert level and issuing guidance to tens of thousands of companies on how to fix the problem. China’s industry ministry urged organizations to immediately inspect their systems and upgrade to the latest secure version of PHP, and recommended strengthening cybersecurity monitoring and changing passwords and keys. Japan’s prime minister encouraged businesses and organizations to patch the vulnerability or shut down their sites.

The extent of successful exploitation remained unsettled across the accounts. Austin said exploitation did not appear widespread; Amazon Threat Intelligence said PHP2Shell was broadly exploited in the wild; and Woźniak said the scale was unclear. The volume of reported attempts was clear, but the assessments differed over how widespread successful exploitation had become.