The short version
- Critical vulnerabilities in PHP, discovered by AI, prompted a global rush to update systems and take sites offline as a precaution.
- The UK government took 36 services offline or partially unavailable, though officials stated no large public-facing critical services were affected.
- Experts describe the event as unprecedented but note there are currently no indications of successful breaches by hackers.
A widespread cyber-security crisis unfolded this week after researchers revealed critical vulnerabilities in PHP, a back-end programming language that has underpinned web development for decades. The discovery, attributed to artificial intelligence tools identifying the flaws, triggered an immediate and chaotic response from organizations worldwide. Websites across multiple sectors were taken offline on Wednesday and Thursday as developers scrambled to apply patches before potential attackers could exploit the severe weaknesses.
The scale of the disruption was significant, with researchers warning that millions of sites relying on unpatched PHP versions were exposed to potential hacks. In the United Kingdom, the government joined the global precautionary shutdowns. Downing Street confirmed that some limited government services were unavailable while security work was carried out. Tech Minister Baroness Lloyd of Effra told the House of Lords that 32 government services were completely unavailable and four were partially unavailable.
Baroness Lloyd attributed these outages to precautionary measures taken to protect systems while updates and mitigations were applied. The government emphasized that this did not indicate a successful hack, but rather a defensive posture. A spokesperson clarified that no large UK public-facing critical services had been affected, although specific details on which services were taken offline were not provided. Work is ongoing across government departments to identify and fix potential exposures.
Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), described the event as unprecedented. Speaking to BBC Radio 4, he suggested the impact would be universally felt but offered reassurance that there were no indications of successful breaches by hackers at this time. The NCSC reported starting to see positive confirmation that advice sent to affected entities was being received and acted upon.
Despite the lack of confirmed attacks, experts caution that the full impact may take months to become apparent. Cyber-security lecturer Rory Hopcraft noted that while hacking is not new, the government’s response highlights the need for public institutions to practice what they preach regarding infrastructure updates. He argued that as rule-setters for other organizations, the government must ensure its own systems are secure.
The disruption extended beyond government services to private businesses and essential local operations. Dean Presley, who runs a garage in Chepstow, South Wales, reported being unable to process MOTs online since Wednesday morning. While physical inspections could still be conducted legally, the digital system failure prevented the printing of paperwork and certificates, causing significant operational delays.
The incident underscores the deep reliance on legacy codebases like PHP in modern digital infrastructure. The involvement of AI in discovering these vulnerabilities marks a shift in how security risks are identified, potentially accelerating the detection of flaws but also raising questions about the speed at which patches can be deployed globally. As organizations continue to update their systems, the focus remains on preventing exploitation while minimizing service disruption.
International cooperation is already underway, with UK experts working closely with OpenAI and international partners to resolve the issues. The situation serves as a stark reminder of the fragility of interconnected digital systems and the importance of rapid response mechanisms in the face of emerging cyber threats. For now, the immediate danger appears contained by precautionary measures, but vigilance remains high.
As the dust settles, the tech community is left to assess the long-term implications of AI-driven vulnerability discovery. While no data breaches have been confirmed, the potential for future exploitation exists if any systems remain unpatched. The event has prompted a broader conversation about the security of foundational web technologies and the need for more robust, automated defense strategies.
In the coming weeks, monitoring will continue to ensure that all critical systems are fully secured. The absence of successful attacks so far is a positive sign, but experts warn against complacency. The incident highlights both the power of AI in enhancing security and the vulnerabilities inherent in widely adopted, older technologies that form the backbone of the internet.
Sources behind this briefing
Go to the original reporting
- BBC World↗Race to update services' computer systems after cyber-security flaw found
- wiz.io↗PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- National Security Agency (.gov)↗NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
