PHP flaws trigger worldwide website shutdowns. What went wrong and who is at risk?

New Delhi: Government agencies and website operators took services offline across several countries on Wednesday as critical security flaws in PHP prompted an urgent international effort to protect vulnerable systems. Emergency fixes are available, but reports of attempted exploitation have intensified pressure on administrators to update the software underlying their websites.

The two vulnerabilities, collectively called PHP2Shell, could allow attackers to run malicious code on affected servers without logging in. Both carry a severity rating of 9.2 out of 10, placing them in the highest category of the standard vulnerability scoring system, according to Singapore’s Cyber Security Agency.

Government websites in Europe were among the services withdrawn while protective measures were prepared. Separately, the internet coordination body, ICANN, said it had temporarily disabled three administrative websites using PHP as a precaution.

The PHP development team released security updates for four supported branches: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It warned that all PHP installations handling web requests should be considered at risk, although the ease of exploitation varies with the server configuration.

The UK’s National Cyber Security Centre urged organizations to locate affected systems, install updates and examine products that contain PHP components. Where updates or temporary protections cannot be applied promptly, its guidance says operators should consider taking systems offline.

Evidence of hostile activity has added urgency to the response. In a security disclosure, Amazon said its decoy monitoring systems detected an exploitation attempt on October 17 before the coordinated public release of technical details and fixes.

Amazon subsequently observed further attempts and said exploitation had spread after disclosure, while cautioning that the success of the earlier attempts against real systems remained unclear. The findings distinguish a developing attack campaign from the precautionary shutdowns, which do not themselves establish that a website has been breached.

Researchers used artificial intelligence to investigate and demonstrate the weaknesses. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz independently discovered and reported the vulnerabilities, describing how AI reduced the work needed to construct functioning attacks.

The PHP Foundation acknowledged that warning signs of one problem emerged in 2024. It attributed delays to difficult technical trade-offs, limited specialist resources and a decision-making process that repeatedly stalled progress and said changes to its security arrangements were under way.

Several providers announced protections, with Automattic saying sites on WordPress.com and specified managed platforms were already covered. Cloudflare also deployed defensive rules but stressed that customers still needed to patch PHP itself.

The potential reach is substantial: W3Techs measures PHP usage at 69.3 per cent among websites whose server-side programming language it can identify. That figure describes PHP’s prevalence, however, rather than the proportion of websites successfully attacked or still exposed after protective updates.

What is PHP2Shell, and why can one software flaw disrupt so many websites?

What does PHP do?

PHP is an open-source programming language used to perform work on a website’s server before information reaches the visitor’s browser. As the PHP manual explains, its code runs on the server and generates the page content sent to the user.

That work can include retrieving articles from a database, processing forms and managing user sessions. WordPress, Drupal, Joomla and MediaWiki rely on PHP, meaning websites with different owners and purposes can share the same underlying software dependency.

What exactly went wrong?

The flaws concern how PHP manages memory and handles failures while processing requests. In one case, running out of allocated memory can leave internal data incompletely initialized; in the other, PHP can retain references to memory that has already been released.

These errors can become security vulnerabilities when attackers manipulate requests to influence what the software does next. Researchers demonstrated circumstances in which the result was remote code execution – the ability to make a server run instructions supplied by an outsider.

Why is the threat unusually serious?

An attacker does not necessarily need a stolen password, an administrator’s approval or a visitor to click a malicious link. Because the weaknesses exist in PHP’s core engine, a website can be exposed even when its own application code has no corresponding flaw.

Wiz said successful exploitation could enable server takeover, website defacement or access to sensitive information held in memory, including authentication tokens and passwords. These are potential consequences of exploitation, rather than evidence that every affected installation has suffered those losses.

Why take websites offline?

Disconnecting an exposed service can give administrators time to apply protections while reducing opportunities for attackers to reach it. The NCSC’s advice makes shutdown a contingency when timely mitigation is unavailable, rather than an instruction to close every PHP website regardless of its protection.

A maintenance page therefore says little about whether information has been stolen. Equally, a website continuing to function normally is not proof that its underlying software is secure: operators must establish whether the relevant fixes have actually been applied.

Will updating WordPress solve the problem?

Updating WordPress, its themes or its plugins alone does not repair PHP, because the vulnerable software sits underneath them. Automattic’s guidance tells owners whose hosting providers manage PHP to obtain confirmation that the server-level update has been installed.

The PHP team says updating is the complete solution, while temporary measures reduce exposure only to particular attack routes. Operators using older releases should check whether their software supplier provides a backported fix or arrange migration to a supported version.

Do firewalls and AI change the picture?

Cloudflare’s web application firewall protections can help identify and block malicious traffic, providing an additional defensive layer. The company nevertheless urges customers to install PHP updates, because filtering attacks and removing the underlying vulnerability serve different purposes.

AI helped researchers turn difficult software weaknesses into demonstrable security findings and coordinate a response before public disclosure. The same ability to accelerate investigation and exploit development can also benefit attackers, narrowing the time available for defenders to protect exposed systems.

What does this mean for Indian websites and ordinary users?

For Indian businesses, publishers and public institutions, the relevant issue is whether their infrastructure contains vulnerable PHP, including within third-party applications. Singapore’s advisory recommends checking beyond an organization’s main website, since other services on its servers may use the language.

For ordinary visitors, the immediate repair rests with website operators and hosting companies; refreshing a browser cannot update a remote server. The practical distinction is between restoring access and establishing security: a service needs the appropriate fixes, while potentially compromised systems also require investigation for any attacker access left behind.