A flaw in the software behind most websites sends governments offline

On Wednesday 21st October, government websites across Europe went dark on purpose. In Britain the Metropolitan Police site and council sites in Edinburgh, Oxford, Bristol, Lambeth and Barnet were among those taken offline,¹ and Finland, the Netherlands, Germany, France, Belgium and Australia did the same with some of their own.²

None of them had been hacked, as far as their operators knew. They were hiding from a flaw in PHP, the programming language that runs on the web servers behind most of the internet's websites.

What PHP is, and what went wrong

When someone opens a page on a PHP site, PHP builds the page on the server before sending it to their browser. WordPress, the most widely used website software, is written in it. According to W3Techs, which surveys the web's most visited sites, PHP runs 69.3% of the websites whose server language it can identify.³

The PHP project announced two flaws, which security researchers named PHP2Shell. Both allow what is called unauthenticated remote code execution: someone anywhere on the internet, without logging in, can send a crafted request that makes the server run their own commands, which amounts to taking control of it.⁴ Both were rated 9.2 out of 10 for severity.⁴ According to Wiz, one of the security companies that reported them, they affect every PHP version released in the past decade.⁵

The fixes, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, were released on 21st October.⁴ Britain's National Cyber Security Centre, or NCSC, told organisations to update at once. Those that could not apply its temporary mitigations in time, it said, "should consider taking the system offline until it can be fully mitigated."⁶

That advice is why so many sites went down. On 22nd October a minister told the House of Lords that 32 government services were unavailable and four partly so, most as a precaution, according to The Register. She said the government was not aware of any confirmed compromise of central government systems.²

×

A secret that didn't hold

Serious flaws are normally fixed under an embargo: the people who know keep quiet until a patch is ready, so that defenders and attackers learn about it at the same moment. This one leaked.

According to the PHP Foundation, which funds the language's development, the flaws' official identifiers appeared on forums and social media at about 15:00 UTC on 20th October. That evening the project brought its release forward by a day, and a security firm called Calif mistakenly published a video showing a working attack. At 07:41 UTC on the 21st, Chainguard, a company that sells ready-built software, published fixed versions of PHP more than six hours before the coordinated release. The foundation said that "any attacker could now study the fix in binary form while every other PHP user was still waiting for the release".⁷

Chainguard's chief executive, Dan Lorenc, said his company had not leaked anything, pointing to the public attack demonstrations and reports that the flaws were already being exploited.⁸

There was some evidence that they were. Amazon Web Services said its decoy servers, which are built to attract attackers, recorded an attempt to exploit PHP2Shell on 17th October, four days before the disclosure, and that it was "unclear how the actor acquired exploit information".⁹ Its chief information security officer, CJ Moses, wrote: "An embargo protects defenders only until someone else finds the same bug."⁹ Cloudflare's chief executive, Matthew Prince, said attempts on its network rose to the millions after the disclosure.¹⁰

Found by researchers using AI

The PHP Foundation credits three teams with finding the flaws, and all of them used Artificial Intelligence models in their work. A researcher at Calif, working under OpenAI's Patch the Planet programme, which uses AI to search open-source software for security holes, reported the first on 11th August. Wiz reported on 24th August, and OpenAI reported further ways to exploit them on 18th September.⁷ Wiz, which is owned by Google, credits models from both Google and OpenAI.⁵

The underlying weakness was not new. A 2024 audit of PHP had found the first signs of it, and the foundation says the volunteer security team then failed to agree a fix for two years, which it called a structural failure.⁷ Who deserves credit for the discovery is disputed: The Record reported that Calif credited another researcher with first finding the flaw and writing an exploit.¹¹

Moses argued that AI also helps the other side: "AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit."⁹ A patch shows what was broken, so the time between a fix and a working attack is shrinking, and he recommended that companies measure their patching in hours rather than days.⁹

Where it stands

On 23rd October PHP disclosed a third flaw in the same area, which it described as an "unlikely" route to remote code execution. It will be fixed in the next regular release, and until then the project advises switching off a setting called session upload progress.⁴

Most of the sites taken offline came back once they were patched. What remains unknown is whether anyone used the four days before disclosure, or the hours before patching, to get into servers that have not yet found the intrusion. About a third of PHP sites run versions 7 or older, which the project no longer maintains,³ and for those the fix depends on their operators.