In brief
A nasty flaw in a widely used web programming language has had governments, businesses and millions of websites scrambling to patch servers. The bug, known as “php2shell”, could let attackers run code on PHP-enabled servers, so the UK government pulled some services offline as a safety measure. Cyber‑security experts say the danger is still unfolding, but the rush to update is helping prevent large‑scale hacks.
PHP – the language that powers 70% of the web – just got a glitch that could let bad actors run code on your website without permission.
Since Wednesday, the glitch, dubbed php2shell, has powered a worldwide scramble. Governments, banks, and even Wikipedia temporarily took pages offline while security teams raced to patch every server that might be underneath the PHP “skeleton” that makes a website interactive.
The UK government warned that 32 services were down and four were only half‑working. “It’s mainly precautionary,” said the tech minister, because the patch is now live but could be weeks to fully roll out.
Cyber‑security experts say the flaw lets attackers run commands remotely, which could lead to stolen data or ransomware. “We’re seeing a flood of attempts to exploit the bug – from dozens to millions in a few hours,” said Cloudflare CEO Matthew Prince. “The window to patch is narrowing fast.”
Business owners are feeling the heat too. A UK mechanic with a computer only worked for “a few days”, while an online shop for bicycles lost its ability to process orders. Even a Dutch cyber‑security agency saw their site taken down temporarily.
The lesson? Even the most stable parts of the internet can crack overnight. By the time a fix hits, attackers are already testing.
For now, most sites are back online after patches, but experts warn the full impact could surface over the coming months.
If you run a website or a service that might rely on PHP, act fast: update to the newest version, run a vulnerability scan, and keep an eye on any alerts from security firms.
