PHP Vulnerability Hit by Millions of Attacks Worldwide

The PHP vulnerability that forced governments, newsrooms and websites offline this week is now being hammered by attackers, and the scale is hard to wrap your head around. According to The Guardian, cybersecurity firms say sites worldwide have been hit by millions of attempts to exploit the bug in a language that underpins about seventy percent of the web.

What Actually Happened

PHP is the programming language running behind a huge share of the internet, including WordPress, Drupal, Joomla and Magento sites. Two critical holes were found in it, and the PHP project fixed them on Wednesday. The flaws let an attacker run their own code on a server without logging in, which is about as bad as it gets for website security.

The twist is how the bugs were found. According to the BBC, researchers at the firms Calif and Wiz used advanced AI tools through an OpenAI programme called Patch the Planet. The flaws had sat undetected for more than a decade, and Wiz called them arguably among the most severe ever uncovered.

Why Websites Went Dark

The plan was to reveal the problem later this month alongside a full patch. Instead, details leaked on social media on Tuesday, which forced the PHP Foundation to rush out its warning before a fix existed. That gap is why so many organisations panicked and pulled pages down as a precaution.

The list of affected sites reads like a global roll call. The BBC reported that Finland temporarily shut down its government web services, the Netherlands cyber agency took its own site offline, and Wikipedia pulled some systems. Pages for BBC shows such as Doctor Who and The Traitors went down too, though the broadcaster had not confirmed a link to PHP.

Britain's cybersecurity minister told parliament that thirty-two government services were taken offline, mostly as a precaution while updates were applied. The Guardian added that the national cyber agency sent out fifty thousand alerts and had no reports of successful hacks so far.

The Attacks Are Already Here

Here is where it gets intense. Cloudflare's chief executive said the company saw tens of thousands of exploit attempts in the forty-five minutes after the announcement, then hundreds of thousands within two hours, and millions since. Amazon's threat team said the flaw was now being broadly exploited in the wild.

The US National Security Agency warned that attackers could seize control of web servers, steal sensitive data and move deeper into networks. It said cyber actors were likely to weaponise the bug and called for immediate patching across federal agencies.

Not everyone is sounding the loudest alarm. Ryan Austin, a researcher at Calif who helped find the flaw, said it did not yet look like exploitation had taken off or become widespread. Still, a former head of Britain's cyber agency called it the most serious vulnerability discovered in five years.

Why Small Sites Are Most at Risk

The biggest worry is not Wikipedia or a national government with a huge security team. It is schools, local councils, charities and small businesses that run PHP without dedicated help. The UK agency said the scale was unprecedented and that older systems may not be patchable at all and will need replacing.

Part of the challenge is just finding where PHP is hiding. Sophos expert Don Smith told the BBC the language can sit beneath public sites, content management systems, hosting platforms and third-party products, sometimes without anyone realising. Fixing the problem starts with an inventory.

There is also a quieter danger. A security researcher told The Guardian that criminals or state-backed hackers could quietly nest inside exposed sites, borrowing their servers and internet addresses to launch untraceable attacks or mine crypto. Many owners would never know.

What It Means for You

If you run a site, the fix is to update to PHP version eight point five point twelve, eight point four point twenty-seven, eight point three point thirty-six or eight point two point thirty-five, according to the US cyber agency CISA. Anyone on older versions should ask their host about backported fixes or upgrade fast.

If you are just a user, there is no magic button. Stay alert for odd emails or login prompts, use unique passwords, and turn on passkeys or two-factor sign-in where you can. Some sites may blink in and out for a few days as teams finish patching.

The bigger story is what comes next. AI just helped uncover a decade-old hole in the internet's plumbing, and attackers can use the same tools. Expect more of these races between defenders and hackers, and follow our tech coverage as the PHP vulnerability fallout develops.