Millions of Attacks Hit Websites as PHP Flaw Opens Global Backdoor

Cloudflare counted tens of thousands of attempts to exploit a critical PHP vulnerability within 45 minutes of its disclosure on Wednesday — and "hundreds of thousands within two hours, and millions now," according to CEO Matthew Prince.

The flaw sits in PHP, the programming language that underpins roughly 70% of the world's websites. The US National Security Agency warned it could let attackers seize control of web servers, steal sensitive data, disrupt services and move deeper into networks. Governments and companies pulled websites offline before patching, with many returning soon after. The BBC's Traitors site was among those down on Thursday.

The bug, tracked as PHP2Shell, is "now being broadly exploited in the wild," Amazon Threat Intelligence said. The company identified several attempts from multiple actors to test ways to capitalize on the vulnerability before PHP developers released the fix on Wednesday.

By Grace Kim, Business Bearings

How serious is this flaw?

Ciaran Martin, former chief executive of the UK's National Cyber Security Centre, called it "very bad" and "the most serious vulnerability discovered for five years." Most internet software vulnerabilities don't matter, he said — this one does.

Wiz, one of the research organizations that uncovered the flaws, went further, calling it arguably among the most severe software vulnerabilities ever found. In a blogpost, the company said the underlying flaws had been present for decades, but exploiting them required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve."

Then AI changed the math. "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," Wiz wrote.

Not everyone sees evidence of mass compromise yet. Ryan Austin, a researcher at cybersecurity company Calif who was key to discovering the flaw, said: "At the moment it doesn't look like exploitation has taken off or been widespread."

The takeaway: severity is undisputed, but confirmed mass breaches are still unproven.

Was the disclosure handled badly?

Cloudflare saw thousands of exploitation attempts in the 10 hours before the vulnerability was publicly announced. Prof Alan Woodward, a cybersecurity expert, said the flaw was revealed a day before the patch shipped — and that "somebody let the cat out of the bag."

That gap gave attackers a head start. Cloudflare's overnight figures — from Wednesday into Thursday — show the pace accelerating after disclosure.

The takeaway: the disclosure sequence handed criminals a window, and they used it.

What can attackers actually do?

Michał Woźniak, an internet infrastructure expert, said hostile actors could "grab the resources" of exposed sites. A site such as Slack or Wikipedia controls computing power, servers and IP addresses — and in many cases PHP manages that infrastructure.

The attack scenarios he outlined:

• Criminal groups, state-sponsored hackers or crypto miners could "nest" inside exposed sites and repurpose their resources
• Hackers could launch attacks from an exposed site's IP address, hiding their origin
• Crypto miners could run energy-intensive calculations on someone else's servers for free

Woźniak said it's unclear at what scale this has already happened, and many sites wouldn't even know.

The takeaway: the real cost may be hijacked infrastructure, not just stolen data.

Who is most exposed?

The flaw has sparked particular concern about systems run by schools, local governments and charities — organizations that may lack dedicated cybersecurity support to execute the fix.

Governments moved fast. The NSA said cyber-actors are "likely to weaponise PHP2Shell" and that the risks are "serious enough to require immediate patching across US government departments and agencies."

South Korea activated emergency response measures on Thursday, raising its private sector cybersecurity alert level and issuing guidance to tens of thousands of companies. China's industry ministry urged organizations to immediately inspect their systems, upgrade to the latest secure version of PHP, strengthen monitoring, and change passwords and keys. Japan's prime minister told businesses to patch the vulnerability — or shut down their sites.

The takeaway: patching capacity, not the flaw itself, now decides who gets hit.

The exposure window is closing as patches spread, but organizations without security teams — schools, councils, charities — remain the soft target, and nobody yet knows how many sites attackers nested into before the fix landed.