The British government is working to identify potential exposure in its online services after critical cyber-security vulnerabilities were discovered in PHP, a programming language that underpins millions of websites worldwide, according to the National Cyber Security Centre.
Governments across the globe and major corporations, including Amazon, are rushing to secure systems that rely on PHP before hackers can exploit the weaknesses. The flaws were initially identified using artificial intelligence, prompting urgent warnings from cyber-security agencies in the UK, EU and Australia.
A UK government spokesperson has urged “all organisations, private and public, large and small” to follow official guidance to protect their systems. The NCSC advised that where immediate fixes cannot be applied, organisations should consider taking affected systems offline until they can be fully secured.
Multiple attempted attacks on Amazon
Amazon disclosed on Wednesday that it had identified exploitation attempts targeting the PHP vulnerabilities, with the first attack occurring on 17 October. The company’s security chief CJ Moses said an anonymous internet address attempted to exploit weaknesses in one of Amazon’s decoy systems, known as “honeypots”.
The attacks took place before an embargo on the security warning was lifted, raising questions about how threat actors learned of the vulnerabilities. “It was unclear how actors knew about the vulnerabilities,” Amazon stated.
Details of the flaw were leaked on social media on Tuesday, ahead of the PHP Foundation’s planned release later this month. Following the leak, Amazon detected additional attacks on 21 October involving varied payloads and anonymisation methods, suggesting multiple actors were involved.
AI transforms cyber-security landscape
The incident has highlighted how artificial intelligence is fundamentally changing cyber-security threats. Anna-Maria Arabia, chief executive of the Australian Council on AI Strategy, told the BBC that “what used to take months, to expose a vulnerability, is now taking days”.
Moses noted that AI enables “more actors can act within hours or even minutes once technical details of a vulnerability are disclosed”. Arabia warned that such threats will only become more frequent as AI technology continues to advance rapidly.
The PHP vulnerabilities had remained undetected for at least a decade. Cyber-security firm Wiz has estimated that roughly 70 per cent of the internet is affected, though this figure has not been independently verified.
PHP powers numerous platforms including online shops, Wikipedia and WordPress, the content management system used by countless websites. When users visit a PHP-powered site, the code collects and presents information in a readable web format.
Several governments took precautionary measures following the warning. The Dutch cyber-security agency went offline, whilst Finland’s government shut down its public web services. Wikipedia also temporarily disabled parts of its website, following advice from governments including the United States to take sites down if vulnerabilities could not be immediately addressed.
The US National Security Agency warned that the vulnerabilities “often provide a direct path to the server’s file system or database”, potentially allowing attackers to steal sensitive data, disrupt services or penetrate deeper into networks. The agency emphasised that these are flaws in PHP itself, not in hosted applications or their configurations.
OpenAI described the discovery as “one of the most impactful security issues in recent memory”.
What this means for Poles in the UK
Polish residents in Britain who run small businesses, blogs or online shops using WordPress or other PHP-based platforms should check with their web hosting provider to ensure security patches have been applied. The NCSC guidance is publicly available on the agency’s website and applies to all organisations operating in the UK, regardless of size.
Anyone who manages their own website or server should prioritise updating PHP to the latest patched version immediately. If you use UK government online services and notice temporary outages, this may be due to precautionary measures whilst security teams work to identify and fix any exposure.
Polish-run businesses that handle customer data through PHP-based systems should verify with their IT support or hosting company that protective measures are in place, as any breach could carry significant penalties under UK data protection law. Those unable to apply fixes immediately should consider following NCSC advice to take systems offline until full mitigation is possible.