The UK government said it is assessing whether its own online services have been exposed after serious security weaknesses were found in PHP, the programming language behind a large share of the world's websites, according to BBC reporting.
Public bodies and major technology firms, Amazon among them, are moving quickly to shield systems running PHP from attackers. The flaws were surfaced by artificial intelligence, and authorities in several countries have since told anyone running PHP to fix them without delay.
A UK government spokesperson said organisations of every kind — public and private, large and small — should act on official guidance to secure their systems, the BBC reported.
Why it matters
PHP is embedded in an enormous range of services, from online stores to Wikipedia and WordPress, the content management system that sits behind countless blogs and websites. When a visitor loads a page, PHP is the code that gathers the requested information and assembles it into something readable.
Because the language is so widely deployed, a flaw in PHP itself reaches far beyond any single company or site. The US National Security Agency said the vulnerabilities tend to open a direct route into a server's file system or database, which could let attackers take sensitive information, knock services offline, or gain a foothold deeper inside a network. The NSA stressed that the problem lies in PHP rather than in the applications built on top of it or in how they are configured.
Cyber-security firm Wiz estimated that roughly 70% of the internet is affected, a figure the BBC said it could not verify independently.
Agencies advised fixes, or taking systems offline
The UK's National Cyber Security Centre, together with counterparts in the EU and Australia, told PHP users to install the available fixes. Where a fix could not be applied straight away, the NCSC said organisations should weigh taking the affected system offline until the risk could be fully addressed.
Several bodies followed that advice. The Office for Budget Responsibility said it had taken its website down in light of the critical issues affecting PHP. Council websites in Edinburgh and Oxford went offline on Wednesday before returning. The Dutch cyber-security agency went offline as a precaution, Finland's government shut down its public web services, and Wikipedia removed parts of its site. The BBC also reported that pages for several of its programmes, including Doctor Who and The Traitors, were unreachable, though no link to PHP had been confirmed and the BBC said it had sought comment.
Amazon reports attempted intrusions
Amazon disclosed on Wednesday that it had detected an attempt to exploit the flaw, which it called a "PHP2Shell exploitation attempt", on 17 October. According to the company's security chief, CJ Moses, an anonymous internet address tried to hit weaknesses in one of Amazon's decoy "honeypot" systems. The use of an anonymous address pointed to a threat actor, he said.
The PHP Foundation had planned to publish its findings later this month alongside a complete fix, but details of the flaw leaked on social media on Tuesday. Further attempts on Amazon on 21 October showed differing payloads and anonymisation setups, which Moses said suggested more than one actor was involved. Those attempts came after the leak but before the warning embargo was lifted, and Amazon said it was not clear how the actors had learned of the vulnerabilities.
Moses added that AI makes it possible for more actors to move within hours or even minutes once technical details of a weakness become public.
Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, told the BBC that the episode showed how fast AI is reshaping cyber-security, noting that exposing a vulnerability once took months and now takes days. She warned that such threats would become more common as the technology improves, saying the trend is "not going backwards, in other words".
OpenAI described the discovery as one of the most significant security problems in recent memory.
What to watch: whether the UK uncovers exposure in its own services, and how quickly organisations that took sites offline restore them once patches are confirmed.
