Critical flaws found in PHP affecting majority of websites worldwide

Summarised from 4 outlets · 6 reports · Updated 23 Oct, 15:58 · Archive

Severe vulnerabilities discovered in PHP, the programming language powering 70 per cent of websites, have triggered a global emergency response.

Severe vulnerabilities in PHP, a programming language powering around 70 per cent of websites, have triggered an urgent global response from governments and organisations. The flaws could allow hackers to take over websites that have not been patched. Security experts announced the vulnerability on Wednesday, prompting immediate action across the digital infrastructure.

IT and cyber workers have reported intense pressure in recent days. Microsoft boss Satya Nadella told a conference he had not witnessed a comparable emergency 'in a long, long time', acknowledging the toll on IT and security staff. UK-based system administrator Adam Mudd reported losing substantial sleep while working until 22:30 BST to secure his customers' systems. He described the experience as 'relentless', managing clients requesting sites be taken offline while coordinating updates across different setups.

The response will not be swift across all organisations. Felix Kuhlenkamp, head of security at German digital industry association Bitkom, noted that larger operators had already implemented updates, but complex IT systems and smaller organisations face longer timescales. 'They may run a website using PHP but don't really keep a close eye on it,' he said. 'If a website is based on an old version of PHP for which there is no security update, the entire system must be updated.'

Cyber security professionals warn the PHP crisis may be just the beginning. Jason Clinton, chief information security officer at Anthropic, warned that 'a vulnerability tsunami is coming in just a few months and there won't be enough time to patch critical infrastructure'. Experts suggest threats will 'get a lot worse before they get better' as artificial intelligence models become more powerful and accessible, making it easier to discover and exploit long-hidden software flaws.

For individual users, options are limited beyond hoping the services they use are not affected or are being actively patched. Security researcher Emily Austin recommended using unique passwords for individual websites and monitoring transactions, but acknowledged that for PHP vulnerabilities specifically, 'there really isn't much an end user can do'.

How it is being reported

• AI's 'Black October': Critical PHP flaws set off global security scrambleGovernments and businesses around the globe are scrambling to contain the fallout after the PHP vulnerabilities leaked online.CNBC · 23 Oct, 16:18
• PHP crisis: What you need to do as the world panics about AI cyber attacksOnly those running websites need to respond directly to the major hacking threat – but there is plenty that civilians can do to protect themselves tooIndependent Tech · 23 Oct, 15:39
• Things will get ‘a lot worse before they get better’, experts warn amid AI security panicCrisis over PHP programming language may not be over for some time – and is just a hint of what’s to come, say cybersecurity professionalsIndependent Tech · 23 Oct, 15:31
• 'It's been relentless' say IT workers on frontline of PHP cyber-security scrambleIT and cyber experts have told the BBC about their struggles in the last 48 hours to update their systems.BBC Technology · 23 Oct, 13:00
• Things will get ‘a lot worse before they get better’, experts warn amid AI security panicCrisis over PHP programming language may not be over for some time – and is just a hint of what’s to come, say cyber security professionalsIndependent Tech · 23 Oct, 12:13
• Hacking attempts rise after flaws found in program affecting 70 percent of websitesGovernments around the world are rushing to implement safety measures after AI technology found 'severe' vulnerabilities in a key programming language called PHP.NPR · 23 Oct, 10:37

In this story: PHP · Microsoft · Satya Nadella · Felix Kuhlenkamp · Adam Mudd · Bitkom · Jason Clinton · Anthropic

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem