The UK government is working to identify exposure in its online services after researchers used AI to uncover flaws in the PHP programming language. Attackers began probing systems before the full fix was released.

 

What happened

Cybersecurity researcher Ryan Austin discovered critical flaws in PHP, a language that powers online shops, Wikipedia, and WordPress. The PHP Foundation planned to release its findings and a complete patch later this month. Details of the flaw leaked on social media instead.

Amazon’s security chief CJ Moses said an anonymous internet address attempted a “PHP2Shell exploitation attempt” against one of its decoy “honeypot” systems on 17 October. Further attacks followed on 21 October, after the leak but before the embargo on the warning was lifted.

Organizations then took systems offline. The Office for Budget Responsibility removed its website, the Dutch cybersecurity agency went offline, and Finland’s government shut down its public web services. Wikipedia took down parts of its site. Edinburgh and Oxford council websites also went offline on Wednesday but are now accessible.

Read also: PHP flaws found by AI force governments and major sites offline

 

What was said

The NCSC said, “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”

Amazon said it “automatically detected and restricted malicious scanning attempts targeting this vulnerability.” It also said its threat intelligence system identified it was targeted on Saturday, and that more exploitation attempts followed once the embargo was lifted.

Austin called it “the most serious vulnerability I’ve ever found,” which “started with a hunch that I would not have been able to scratch without AI.” He also said organizations would now “run and patch PHP immediately” if they haven’t already.

 

In the know

PHP is the code that collects the information a visitor needs and presents it in a readable form on the web. Austin described it as “one of the first web languages that powered the early internet.” A “patch” is a software fix for a flaw. A “honeypot” is a decoy system that Amazon uses to detect and study attacks.

 

Why it matters

This incident shows the gap between a vulnerability becoming known and attackers using it closing fast. Details leaked on Tuesday, and Amazon logged attacks before the official warning was even lifted. Defenders had little time to patch before attackers started probing. AI contributed on both sides. Austin said he could not have followed his hunch without it, and Moses said AI lets more attackers act within hours of a disclosure. The same technology that found a decade-old flaw may help attackers exploit one just as quickly. If an attacker runs code on a webserver, they can steal data and move deeper into a network, and the flaw sits in PHP itself rather than in any one organization’s setup. Even a well-configured site is exposed until it patches.

 

The bottom line

The UK government, the NCSC, and its counterparts in the EU, Australia, and the US all gave the same instruction, patch PHP now, or take the system offline until you can. Organizations that run PHP should identify where they use it, apply the fixes, and take any system that cannot be fixed immediately offline.

Related: HIPAA Compliant Email: The Definitive Guide

 

FAQs

What is a vulnerability embargo?

An embargo is an agreed delay in publicizing a flaw so that developers can build a fix before attackers learn the details.

 

What is a content management system?

A content management system is software that lets people create and manage website content without building the site from scratch.

 

What does it mean to take a system offline?

Taking a system offline means disconnecting it from the internet so attackers cannot reach it.