PHP Maintainers Confirm Critical Flaw as Agencies Race to Patch

Developers of the programming language PHP disclosed "critical vulnerabilities" this week, triggering outages at websites around the world and prompting the UK government to pull dozens of services offline as a precaution, according to the BBC.

What flaw was found in PHP, and when?

The flaws were revealed in the back-end language PHP, which has been used in web development for decades, the BBC reported. Sites began going offline on Wednesday and Thursday after the disclosure. Researchers described the vulnerabilities as "severe" and warned they could expose millions of sites that run on PHP to potential hacks if left unpatched.

Which UK government services went offline?

Downing Street said Thursday that "some" limited government services "may be offline" while security work was carried out, per the BBC. Tech minister Baroness Lloyd of Effra told the House of Lords that "32 Government services are unavailable and four are partially unavailable," attributing the disruption to "precautionary measures taken to protect systems while security updates and mitigations are applied." The government did not name the affected services but said no large public-facing critical services had been hit. A spokesperson added that teams across government had already worked to "identify and fix potential exposures to our systems" and were coordinating with outside partners, while stressing that "this does not mean they were hacked, and work continues to resolve any issues," the BBC reported.

Has anyone actually been hacked?

No successful attacks have been reported so far, according to the BBC. Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event "unprecedented" and said it "will be universally felt, I suspect," in remarks to BBC Radio 4's World At One. He said there were "no indications" of any successful breaches, and that the NCSC was "starting to see positive confirmation" that guidance sent to affected organizations was being received and acted on. Experts cautioned, however, that the full impact may take time — potentially months — to surface.

Why does a flaw in PHP matter so broadly?

PHP stands for PHP: Hypertext Preprocessor and is a back-end scripting language that has underpinned web development for years, the BBC noted, meaning a vulnerability in its code can ripple across an enormous number of unrelated sites and services simultaneously rather than being confined to a single company's product.

How is the disruption hitting small businesses?

Outside government, ordinary businesses reported real-world friction. Dean Presley, who runs a garage in Chepstow, South Wales, told BBC Your Voice his computer system had been down since Wednesday morning. "MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," he said, adding that he has had to resort to writing everything on paper, which has caused delays for customers.

What should organizations do now?

Cyber-security lecturer Rory Hopcraft told the BBC the government needs to ensure its own infrastructure is current, saying, "The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point." For now, the NCSC's message to affected organizations is straightforward: apply the security updates and mitigations already issued, and watch for further guidance as patching continues.