In brief
A newly discovered critical flaw in PHP, the language that powers 70 % of the web, has triggered widespread outages and a frantic security response. Major sites, including government and e‑commerce platforms, went offline while operators checked for the vulnerability and applied patches. The flaw, named php2shell, could let attackers execute code remotely if present, raising alarms across the industry. While no confirmed breaches have been reported yet, experts warn that the window for exploitation is shrinking to hours. The incident underscores the need for continuous vigilance and rapid incident‑response capabilities for both public and private sectors.
A critical flaw in PHP, the widely‑used scripting language that powers over 70 % of websites, has forced agencies and enterprises around the world to shut services and rush patches.
The vulnerability, dubbed php2shell, was publicly disclosed on Thursday by researchers at Wazuh, Wiz and the PHP Foundation. It allows unauthenticated attackers to run arbitrary code on servers that use vulnerable PHP versions, a risk that can be exploited within minutes of a hit site.
Government and commercial response
The UK government suspended 32 services and partially disabled four others to protect systems. In France, telecommunications giant Orange halted access to several applications globally. Across the globe, Cloudflare and Amazon reported “millions” of attempts to exploit the flaw before press releases went public.
What the industry is learning
Security experts warn that the patch window has narrowed from days to hours. Matt Hull of NCC Group notes that the speed of modern exploitation demands stronger resilience built into both people and technology, with teams urged to share workloads and rest when the pressure mounts.
While no confirmed hacks have emerged from the incident, the vulnerability’s widespread nature means its full impact may surface over months. Governments and businesses alike are now prioritising regular updates, code audits, and incident‑response plans to mitigate future surprises.
