Serious PHP Flaw Takes Websites Offline Worldwide as Hackers Try Millions of Exploits

A serious vulnerability found in PHP, the programming language underlying countless websites worldwide, has led governments and companies to temporarily disconnect websites from the internet. Cyber-security agencies said millions of attempts have already been made to exploit the flaw.

The US National Security Agency warned that attackers could use the flaw to execute code remotely, take control of web servers, steal data, disrupt services and move deeper into networks.

The problem was discovered on Wednesday in PHP, on which around 70 percent of the world's websites are based. Governments and companies then took websites offline so the flaw could be patched before an attack.

In the United Kingdom, 32 government services were temporarily kept offline, Cyber Security Minister Liz Lloyd told Parliament. She said they were mainly closed as a precautionary measure while systems were updated.

Downing Street said no service important to the public had been harmed. Some limited services might be temporarily closed, but that did not mean they had been hacked. On Thursday, the website of the BBC programme 'Traitors' was also offline.

The incident raised particular concern about systems used by schools, local government and charities, because those institutions may not have the cyber-security support needed to fix such problems.

Ciaran Martin, former chief executive of the UK National Cyber Security Centre, called the flaw 'very bad'. He said that while most software vulnerabilities on the internet are not very important, this was 'the most serious vulnerability discovered in the last five years'.

However, Ryan Austin, a researcher at the cyber-security company Caliph who played a key role in finding the flaw, said it did not appear that the flaw had been used for a major attack or spread widely.

Governments in several countries were forced to act quickly. Government websites were shut down rapidly so the necessary patches could be installed; many later came back online.

Cloudflare chief executive Matthew Prince said in an update between Wednesday night and Thursday that within 45 minutes of the problem being announced, several thousand attempts to exploit the vulnerability were detected on their systems. Within two hours the number rose to several hundred thousand, and later reached several million.

Experts are advising website operators to apply patches quickly, check server logs and monitor for unusual access attempts. For small organisations, the incident has again highlighted the importance of regular updates and backups.

Overall, the incident showed how a single flaw in a widely used programming language can simultaneously put everything from government services to entertainment websites around the world at risk.