\n
The UK government says it is working to actively identify and patch any potential exposure in its online services, after vulnerabilities were identified in the PHP programming language that underpins a significant number of the world’s websites. <\/b><\/p>\n
Governments and some of the world’s biggest companies, including Amazon, were scrambling to protect their systems on Thursday before hackers could exploit them. <\/p>\n
The flaws were first discovered by AI, after which governments and agencies urged websites to address them.<\/p>\n
Amazon was targeted in multiple attempts, which it said occurred before an embargo on the warning was lifted. It added that it was unclear how actors knew about the vulnerabilities. <\/p>\n
A UK government spokesperson urged “all organisations, private and public, large and small” to follow guidance to protect their systems. <\/p>\n
The UK’s National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.<\/p>\n
“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said in a note.<\/p>\n
Amazon announced on Wednesday that it had identified a “PHP2Shell exploitation attempt” that occurred on 17 October. <\/p>\n
In the attack, an anonymous internet address attempted to target weaknesses in one of Amazon’s decoy or “honeypot” systems, the company’s security chief CJ Moses said. <\/p>\n
The use of an anonymous IP address suggests that the activity was conducted by a “threat actor”, he said. <\/p>\n
While the PHP Foundation intended to release its discovery later this month along with a complete fix for the problem, usually referred to by software developers as a “patch”, details of the flaw were leaked on social media on Tuesday.<\/p>\n
In subsequent attacks on Amazon that occurred on 21 October, “the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors,” Moses said. <\/p>\n
The attacks occurred after the leak, but before the embargo was lifted on the PHP warning.<\/p>\n
The use of AI means that “more actors can act within hours or even minutes once technical details of a vulnerability are disclosed”, Moses added. <\/p>\n
The PHP incident has “demonstrated how quickly AI is changing our cybersecurity landscape”, Australian Council on AI Strategy CEO Anna-Maria Arabia told the BBC, as “what used to take months, to expose a vulnerability, is now taking days”.<\/p>\n
She warned that threats would only become more commonplace as AI technology rapidly improves. It is “not going backwards, in other words”, she said.<\/p>\n
The PHP flaws went undetected for at least a decade.<\/p>\n
Cyber-security firm Wiz has estimated that “roughly 70%” of the internet is affected, though the BBC is unable to independently verify that figure. <\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n- \n
<\/p>\nWhat is PHP and why did it spark a global cyber security scramble?<\/span><\/p>\n<\/span><\/p>\n
![\"The](\"https:\/\/260web.com\/news\/wp-content\/uploads\/2026\/10\/43fpAI.jpg\")
<\/picture><\/span>Getty Images<\/span><\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n![\"The](\"https:\/\/ichef.bbci.co.uk\/ace\/standard\/240\/cpsprodpb\/f340\/live\/eba975d0-cdcc-11f1-bd0d-75577ccf219c.jpg.webp)
<\/picture><\/span>Getty Images<\/span><\/div>\n<\/figure>\n<\/div>\n<\/div>\n<\/div>\n