Severe vulnerabilities in the PHP: Hypertext Preprocessor identified with the help of AI this week have led cybersecurity experts to issue warnings about potentially millions of affected sites
PHP vulnerabilities were identified with the help of AI(Image: Getty Images)
PHP cyber security vulnerabilities have seen 32 Government services taken offline and four left partially unavailable, the Government has said, as part of what it says are “limited” outages as they undergo works.
Agencies and national governments around the world were forced to act on Wednesday after AI-backed technology brought to light vulnerabilities in the PHP: Hypertext Preprocessor content management system. PHP is the scripting language for web development behind sites like Wikipedia and WordPress, and security researchers launching a probe into its inner-workings using OpenAI technology uncovered a flaw that could allow would-be attackers to take control of affected web servers.
No large UK public-facing critical services have been affected, a No 10 spokeswoman said on Thursday, stating that work has “taken place across Government” to fix potential exposures to official systems.
To see more of the stories you love from The Mirror and to find them easily in Google then make us your preferred source. Free and easy-to-do, just click on the link here to find more from The Mirror at the top of your feed.
The official told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue. No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.
“But this does not mean they were hacked, and work continues to resolve any issues.” The spokeswoman said it was not “standard practice” to provide a list of Government services that were affected.
Surfshark VPN
Surfshark is a Virtual Private Network tool that helps protect sites and helps prevent malicious viruses.
It came after cybersecurity chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in PHP, which is used by almost 70% of websites according cybersecurity firm Cloudflare. Experts have outlined just how serious the situation is for PHP-backed websites, saying the vulnerability could hand bad actors data and wide access to critical networks of government and business pages.
Speaking to BBC Radio 4’s Today programme, Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said it is the scale and nature of the vulnerability that makes it so serious. He told the programme: “We’re talking something like 30 million websites out there – we’re certainly getting off of that number – but also the nature of it.
“It’s not just the the vast volume of websites that use it, but this is called a remote code execution vulnerability, and what that means is an attacker can get their own code onto the web server and run it, and basically do whatever they like.
“They can steal data, they can go to other parts of your your network, all sorts of things like that. Even plant the backdoor to get in later on, so you can see, pretty serious.” The PHP Foundation, which is responsible for PHP systems, said it had identified two Common Vulnerabilities and Exposures (CVE’s), CVE-2026-109618 and CVE-2026-109619.
The vulnerabilities exist in “all PHP installations serving web requests”, and go back to PHP version 5, which was released more than 20 years ago in 2004.
PHP 8.2 and newer services, which are still supported by the foundation, will receive patches, it said in an alert issued on Wednesday which warned: “There are no complete mitigations, updating is the only safe choice.”
Since those flaws were identified, there have been “millions” of exploitation attempts launched at PHP-based sites, which include government and business platforms around the world. Among those forced to switch off and update their systems in the UK were the official sites of the Office for Government Responsibility (OBR), Oxfordshire County Council and Hillingdon Council.
Sites were targeted around 10 hours before the vulnerability was announced, Matthew Prince, the CEO of internet services firm Cloudflare said. He wrote on X: “In the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.” Lukasz Olejnik, a visiting senior research fellow at King’s College London, told Wired magazine: “This is not a drill.”
Mr Olejnik, who is also an independent security consultant, added: “The impact is enormous.” He continued: “Especially if attackers would turn to exploiting these vulnerabilities fast. Worst case is wormable malware affecting big chunks of the internet.” Chris Dimitriadis, Chief Global Strategy Officer at ISACA, a nonprofit that develops guidance and best practices for information technology governance, said vulnerabilities can trigger effects “across borders and industries within hours”.
He said: “A single vulnerability can trigger a global domino effect across borders and industries within hours. What we’re seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI.
“But the real concern isn’t just the vulnerability itself. It’s what it reveals about our preparedness. Cyber resilience isn’t something organisations can switch on when a crisis hits.
“They need to understand where they are exposed, recognise their technology dependencies and have the right people, processes and controls in place to respond quickly and effectively. Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a security flaw from becoming a much bigger crisis.”
“Most of all, that means investing in the next generation of cybersecurity professionals, who can use AI to find and fix weaknesses faster than attackers can exploit them.”
A spokesperson for the Government said work was underway to “identify and patch any potential exposure”. They added: “We encourage all organisations – private and public, large and small – to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”
The Government has also confirmed that the security of next week’s Government Budget has not been compromised by the critical security flaw, with Scotland Secretary Douglas Alexander asked whether the issues identified with PHP could result in major leaks because the Office for Budget Responsibility (OBR) took down its website.
He told Times Radio during an interview this morning: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.
“Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.” Last year, the OBR’s Budget analysis was mistakenly published online ahead of then-chancellor’s Rachel Reeves statement to the Commons, allowing for early access to market sensitive information.
Leave a comment