IT professionals across the UK and beyond have told BBC News how the past 48 hours have pushed them to their limits, as they scramble to protect websites running PHP, one of the most widely used programming languages on the internet. Their accounts also reveal how a wave of misinformation made an already serious situation considerably harder to manage.
PHP is the software that runs behind the scenes on a huge proportion of websites. Two critical flaws were discovered in it, prompting national cyber-security authorities to urge IT teams to apply a security fix immediately or take their sites and servers offline.
Round-the-clock work to keep websites safe
UK-based system administrator Adam Mudd said he had never received so many worried messages from clients. ‘It’s been relentless,’ he told BBC News. ‘The biggest challenge has been juggling clients who want their sites taken offline as a precaution, while trying to coordinate updates and fixes across countless different setups,’ he said, adding that taking a website down sometimes took longer than applying the PHP fix itself.
In Mauritius, IT administrator Loganaden Velvindron described a similar picture. His team found that much of the software they support runs on versions of PHP that are no longer officially maintained. ‘Many versions of PHP running are completely end-of-life, so we are having to rebuilding web apps and change code in some cases,’ he said. He added that the public announcement about the flaws came without much warning, leaving teams little time to prepare.
Jon Jones, technical director for a digital advertising company, described the moment the alert arrived as ‘eye-opening’. He said the rush to apply the patch, which the PHP Foundation released at 15:00 BST, felt like ‘the race was on’. He also acknowledged the anxiety that comes with any emergency update: ‘there’s always a chance than an update can cause other issues,’ he said.
The urgency was heightened because someone had leaked details of the flaw before the fix was publicly available, fuelling rumours that cyber-criminals were already exploiting it. Censys, a company that scans internet-facing infrastructure, examined 2.6 million hosts and found that roughly 1.5 million were still running a version of PHP without the fix applied, according to a report by Shattered.io.
Misinformation and ‘alert fatigue’
Despite the severity of the flaws on paper, UK cyber expert Daniel Card said the response was hampered by poor information. ‘We were flooded with rubbish intel about hackers being out there actively with working Proof of Concept (PoC) methods,’ he told BBC News. Card said the situation felt like it had been ‘on another dimension’ compared with previous incidents.
Making matters worse, at least one major cyber-security company issued warnings claiming attackers had a working PoC, only to retract that claim. Cloudflare and AWS both reported that ‘millions of hacking attempts’ had been made every hour, yet BBC News reports there is no evidence of large-scale data breaches or cyber-attacks at this point.
AI tools were involved in the story in two ways: they were used by researchers to uncover the PHP flaws, vulnerabilities that had reportedly gone undetected by human researchers for decades, and they have been used by hackers attempting to build attack methods, though none appear to be working at scale.
Mark Maunder, founder of Wordfence, a WordPress security tool, warned that the communications around the crisis had not been well calibrated. ‘We’re going to find scary vulnerabilities with the amazing capabilities that OpenAI and Anthropic are bringing online, but we need to calibrate the messaging,’ he posted. Maunder said there was a risk of ‘alert fatigue’, a situation in which so many warnings are issued that IT teams begin to discount them, which could prove dangerous if a fully exploitable vulnerability ever emerged without adequate warning.
