Websites around the world have gone offline after a critical software flaw was discovered by artificial intelligence agents.
The vulnerability involves the PHP programming language, which is used by almost 70 per cent of sites.
Governments and businesses took down their websites in an effort to protect their systems from hackers seeking to exploit the issue.
Security updates are available to fix some of the flaws, though cyber officials have warned any organisation unable to apply the fixes to take their websites down in order to prevent breaches.
“Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version,” the UK’s National Cyber Security Centre said in a note.
“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
You can follow all the latest news and updates on the PHP cyber security issue here.
Read MoreWebsites across the world taken down to protect systems as critical cyber-security update issued
Key points
- What is PHP?
- Which websites are impacted?
- How AI is changing cyber security
Opportunistic scams to follow, experts warn
15:46 , Anthony CuthbertsonThere have been no reported breaches from any major company or government, but cyber security experts warn that the scale of the threat means it might not remain this way for long.
A wave of “opportunistic scams” could follow the discovery of the PHP flaws, according to James Mackay, chief executive of cyber training firm MetaCompliance.
“Attackers can use the news as cover to send fake 'urgent patch' alerts, posing as IT support, or setting up lookalike login pages to steal credentials while teams are under pressure to act quickly,” he tells The Independent.
“These are exactly the kinds of attacks that technical fixes alone won't stop... In high-pressure moments like this, the right security training makes the difference between an attack slipping through the cracks and an incident response plan kicking in.”
Why are the PHP flaws so significant?
15:00 , Anthony CuthbertsonOpenAI has called it “one of the most impactful security issues in recent memory”, while researchers at the Google-owned security firm Wiz that found the flaws said it ranked “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.
So what actually happened and why is it so significant?
What is PHP and why has it caused chaos for millions of websites?
PHP exploit exposes web's vulnerability
13:57 , Anthony CuthbertsonWith the pace of development of artificial intelligence, it is likely that major incidents like this will become increasingly common. While they are not easy to anticipate, the damage can be limited by understanding the issue and being ready to act immediately.
Security experts have warned that organisations need to conduct an urgent assessment of their computer systems in order to prevent another crisis like this one.
“The bigger lesson is just how interconnected but at risk our digital ecosystem has become. A single vulnerability can ripple across suppliers, public services and the people who depend on them,” JP Buckley, a partner in the data, privacy and cyber team at the law firm Lewis Silkin, told The Independent.
“Businesses need to understand the software and providers they rely on, and hence where their vulnerabilities lie and act immediately to assess when they arise. That helps determine who is legally responsible for acting when something goes wrong. Those conversations need to happen before the next critical flaw hits – not while organisations are scrambling to respond.”
Which other governments have been hit?
13:37 , Anthony CuthbertsonThe UK is not the only country suffering from this PHP chaos. Here’s all the countries around Europe that have reported incidents with their IT infrastructure:
Belgium - The country’s foreign ministry preemptively took its websites offline.
Czech Republic - The country’s cyber watchdog took down the Czech government’s website to “allow for the implementation of necessary security patches.
Finland - The government’s public web services were knocked offline by state IT centre Valtori on Wednesday.
France - Websites of local prefectures taken offline as a precaution while updates are installed.
Germany - Federal IT service provider ITZBund temporarily took websites down.
Netherlands - Government site Overheid.nl, the national football association KNVB, the Port of Rotterdam and the five largest political parties all took sites offline.
Thirty-two government services are offline, minister says
12:41 , Anthony CuthbertsonA UK minister has confirmed that 32 government services are offline and four are partially unavailable as a result of the PHP security flaw. Downing Street said no major public-facing critical services have been impacted.
A No 10 spokesperson said: "Work has already taken place across government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.
"No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues."
12:32 , Anthony Cuthbertson For a full round-up of everything going on, you can read Andrew Griffin’s piece on the outages here:
Websites across the internet go down as hackers launch millions of cyber attacks
'Millions' of hacking attempts
12:01 , Anthony CuthbertsonA leading cyber security firm has revealed that hackers are making “millions” of attempts to take advantage of the PHP security flaw.
Cloudflare, which is used by millions of websites to protect against cyber attacks, was able to observe the attempts to exploit the PHP2Shell exploit in real time.
“In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” says Cloudflare CEO Matthew Prince. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
Why you don't need to change your passwords
11:33 , Anthony CuthbertsonAs with any major cyber attack, users will be wondering whether they need to change their online passwords in order to protect their accounts. Unlike other cyber attacks, this one is far more widespread than a single website or company.
With nearly 70 per cent of websites impacted globally, updating passwords would be a huge undertaking, though the average web user should not worry just yet. This security flaw is a server-side vulnerability, so changing passwords for the average user is unnecessary. Even for website admins, the priority right now is to apply the official PHP security patch, as the exploit bypasses login screens.
Having said that, it’s always good practice to regularly update passwords and use multi-factor authentication.
What happens if the PHP flaw is exploited?
11:21 , Anthony CuthbertsonThe vulnerability discovered in the programming language PHP, known as PHP2Shell, is far more dangerous than a typical cyber bug.
Because the flaw lies within the underlying PHP rather than a specific website or application, an attacker could potentially bypass all authentication measures like login screens. With full access to a web server, a hacker could install malware, carry out a ransomware attack, deface websites, steal private data, or even destroy an entire platform from within.
The threat it poses to both website operators and regular web users is why some organisations have taken the extreme measure of taking their sites offline to prevent cyber attacks.
Taking websites offline is 'far cheaper'
10:32 , Anthony CuthbertsonTaking a website or service offline, even for a couple of hours, can be hugely damaging for organisations, though it may still be better than the alternative.
“Taking a website offline for a day is a far cheaper decision than explaining a breach for a year,” Samuel Hassine, CEO and co-founder of the cyber tech firm Filigran, tells The Independent.
“The agencies asking organisations to do exactly that are giving sound advice, and the speed of the coordinated response shows how much the discipline has matured. These flaws sat in code that dates back to 2004 and were found with AI. The same tools will help attackers move just as fast, and early attacks are already being reported.”
Has the PHP flaw been exploited?
10:10 , Anthony CuthbertsonWhile a lot of pre-emptive measures have been taken to protect against the vulnerability, there is no evidence yet that it has actually been exploited by hackers on any significant scale
The security flaw actually dates back to 2004, yet had gone undetected until AI agents discovered it.
Attackers are now using other AI tools to try and take advantage of vulnerable systems, with security analysts uncovering evidence that some exploits are already out there.
Amazon Web Services (AWS) noted early attempts to exploit it on 17 October, before any patches were announced, yet no major organisation has revealed if their systems have actually been compromised.
National Cyber Security Centre issues advice
09:38 , Anthony CuthbertsonThe UK’s National Cyber Security Centre (NCSC) is urging all impacted organisations to update their systems immediately, or take their sites offline to prevent cyber attacks.
The first and most crucial step is to identify which systems are actually running PHP, which is a complex task considering how tangled some web infrastructure is.
“Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version,” the agency stated.
“Organisations using older versions of PHP are highly encouraged to update to a fully supported version... Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP.”
NCSC has published a useful inventory list of software products that use PHP.
AI has made cyber attacks easier than ever
09:28 , Anthony CuthbertsonNot only is AI helping researchers discover vulnerabilities, as it did it with this PHP incident, it is also helping hackers exploit them.
We’ve heard from Shane Fry, chief technology officer at the software firm RunSafe Security, who says that new AI tools make it easier and faster than ever to attack vulnerable systems.
“Historically, turning a complex memory-safety bug into a reliable attack required significant expertise and time, repeated testing, and a detailed understanding of the vulnerable software,” Fry says.
“AI is dramatically reducing that effort, as can be seen by working proof of concepts being deployed within hours of the CVE details being leaked. We can no longer assume that a vulnerability is relatively safe simply because exploitation appears too difficult. Organizations need to harden software at runtime so attackers cannot reliably turn memory corruption into control of a system.”
What is PHP?
09:17 , Anthony CuthbertsonThe global cyber incident all stems from a ubiquitous programming language called PHP – short for PHP: Hypertext Preprocessor – which is used to build websites.
First released to the public in 1995, it became a global standard for web servers in the early 2000s.
Even if you haven’t heard of it before, you most likely interact with it regularly through sites and platforms like Wikipedia and WordPress.
The security flaw that was discovered by AI agents has actually been around for more than a decade, but only just been detected.
It has been described as the “most severe” vulnerability ever discovered by AI, with ChatGPT creator OpenAI calling it “one of the most impactful security issues in recent memory”.
Which websites are impacted?
08:53 , Anthony CuthbertsonNearly 70 per cent of all websites globally run PHP, according to figures from Cloudflare, and all are impacted by this security issue.
Updates are available, though one of the challenges for big organisations is finding where PHP is running within their systems and implementing the patch.
Government websites in Finland, the Netherlands, and the UK have been taken offline to prevent cyber attacks while they install updates.
Other sites that appear to be offline include the Paris police force, the Port of Rotterdam, DeviantArt, parts of Wikimedia and 4Chan.
Hello and welcome...
08:31 , Anthony Cuthbertsonto The Independent’s coverage of the global scramble to fix a major cyber security flaw impacting millions of websites.
We’ll have all the latest news, updates and analysis right here.
