In brief
A newly discovered vulnerability in PHP, dubbed php2shell, exposes hundreds of millions of websites to remote code execution. Governments including the UK have taken 32 services offline as a precaution, and major tech firms have reported massive attack attempts. Cybersecurity experts warn the window to patch has shrunk to hours, while small businesses face sudden operational disruptions. As firms scramble to apply fixes, the incident underscores the interdependence of global digital infrastructure.
On 18 October, cybersecurity researchers announced a critical flaw dubbed php2shell that could let unauthenticated attackers run code on any server running the widely used PHP language. The vulnerability, now known to have affected many past versions of PHP, is an “unrestricted remote code execution” risk that could expose millions of websites worldwide.
PHP, short for Hypertext Preprocessor, is the server‑side language behind popular sites such as Wikipedia, WordPress and countless online shops. Since the early 1990s it powers an estimated 70 % of the internet’s sites, according to a report by cyber‑security firm Wiz.
The United Kingdom’s government quickly brought 32 services offline, citing precautionary measures while patches were applied. Tech minister Baroness Lloyd of Effra told the House of Lords that the services were “largely” disrupted by design, not by a successful attack. The National Cyber Security Centre (NCSC) said it saw no evidence of successful breaches, though it highlighted that the flaw would be “universally felt” if left unpatched.
Major internet security firm Cloudflare reported skyrocketing attack attempts. Within ten hours of the flaw’s public disclosure, the company logged thousands of attempts, which swelled to tens of thousands within 45 minutes and millions within two hours, according to a tweet by its CEO Matthew Prince. Amazon confirmed that its websites remained online during the rush.
International operators from across the European Union and beyond responded swiftly. French telecoms giant Orange shut down access to certain PHP‑based services worldwide and deployed patches. Dutch cybersecurity agencies and Finland’s government also rolled back services temporarily, restoring them the following day after verification.
Not all ramifications were limited to large organisations. Small businesses faced immediate operational glitches. For instance, a garage in Chepstow, Wales, could no longer process motor‑vehicle tests online and had to revert to manual paperwork, delaying services for customers. Such disruptions highlight the uneven impact of a systemic flaw on local economies.
Cyber‑security experts stress the urgency of patching, noting that the window to respond has narrowed dramatically. According to Matt Hull of NCC Group, attackers can exploit vulnerabilities in days or even hours, putting immense pressure on developers, system administrators and national governments alike. While the long‑term consequences remain to be fully understood, the current debate reflects a broader clash between rapid digital deployment and robust security practices.
Across the spectrum, the incident has prompted a collective argument for stronger oversight and immediate vulnerability remediation. Governments are being called to set the standard, while businesses are urged to mirror the same diligence in their own infrastructure. Simultaneously, the debate about the role of AI in identifying and patching such critical flaws continues in earnest, as the flaw was partly discovered using tools from OpenAI.
