PHP flaws prompt urgent patching across the web as attack attempts climb
Organisations are still checking exposure, and experts warn the fallout may take months to fully emerge.
Developers of the PHP programming language disclosed critical vulnerabilities in the back-end language, which researchers have dubbed "php2shell" and say could let unauthenticated attackers run code remotely on affected servers. Cyber-security firm Wiz said PHP powers around 70% of the world's websites and that the flaws are inherent to the language, affecting many past versions. Organisations responded by taking sites offline while they checked for exposure and applied patches. In the UK, 32 government services were unavailable and four partially unavailable, which officials attributed to precautionary measures, while the National Cyber Security Centre reported no confirmed successful breaches so far. Cloudflare reported attack attempts rising from thousands to millions shortly after the announcement, and experts warned that the effects could take months to fully emerge.
Why it matters
Because PHP underpins a large share of the world's websites, the flaws reach far beyond developers who write PHP code. Site owners and the public who rely on those sites face disruption while patches are applied, and the reported rise in attack attempts means the window of risk is active now. No confirmed successful breaches have been reported so far, but the full consequences are not yet known.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.
Sources
- BBC Technology