PHP Security Flaws Spur Urgent Fixes and Strain IT Teams

Two critical flaws in PHP, a programming language used by millions of websites, triggered an urgent security response and left IT teams scrambling to update systems. The PHP Foundation, which manages the language, released a fix after details of the flaws were leaked early.

System administrator Adam Mudd, who works in the UK, told the BBC he had received more worried messages from website owners than ever before. He said he was coordinating updates across many different systems while handling requests from clients who wanted websites taken offline as a precaution. Mudd said he worked early and stayed on the job until 22:30 BST to secure customers' systems.

In Mauritius, IT administrator Loganaden Velvindron said some PHP versions in use had reached end of life, requiring teams to rebuild web apps and change code. Digital advertising company technical director Jon Jones said the patch launched at 15:00 BST on Wednesday and described the rush to apply it as a race, while noting updates can cause other problems.

Rumours that attackers had working proof-of-concept methods spread alongside the warnings. UK cyber expert Daniel Card said teams were flooded with false information. The BBC reported no evidence of large-scale data breaches or cyber-attacks, despite warnings of millions of hacking attempts every hour from Cloudflare and AWS. It also reported that AI had been used to find the PHP flaws, which had eluded human researchers for decades, and that experts expect AI tools to uncover serious vulnerabilities more often.