Cyber security centre warns PHP hacking situation could worsen

Researchers found at least two serious weaknesses in PHP, a programming language used across much of the web. Details were leaked online on Monday, before the developers planned to release an upgrade by Wednesday afternoon. Public disclosure made the problem urgent because attackers could study the weaknesses while many sites were still unpatched.

The warning quickly became concrete. Amazon reported an attack attempt on October 17. Cloudflare said attempts came from thousands of sources before the upgrade and from millions afterwards. The NCSC then investigated international reports of successful website hacks, although it had not confirmed whether those reports were accurate.

The response spread beyond cybersecurity teams. Government, healthcare, and news websites temporarily went offline while waiting for the upgrade, including Dutch News. The Netherlands acted early, and Belgium, Germany, France, and Finland followed. The NCSC said there was no sign of abuse involving Dutch websites, while privacy watchdog AP reported no linked breaches.

PHP is a programming language used to build and run websites. The article describes it as the language on which a majority of the web is built. This means PHP is not a problem affecting one company or one website. A weakness in its shared code can create risk across many different online services.

Researchers found at least two serious vulnerabilities in PHP code. Websites using vulnerable PHP versions could therefore require urgent checking and updating, even if their owners had not written the flawed code themselves. The article does not explain the exact technical weaknesses, but it records hacking attempts and reports of possible successful hacks.

The scale made the response international. Government, healthcare, and news sites temporarily went dark while waiting for an upgrade. The Netherlands acted quickly, followed by Belgium, Germany, France, and Finland. The NCSC called the situation capable of rapidly worsening, showing why widely used software needs coordinated protection.

The article gives PHP an exceptionally broad reach, saying it is the programming language on which a majority of the web is built. It does not provide a percentage or a precise number of websites. Still, that description explains why a flaw in PHP quickly became an international concern rather than a local technical issue.

The reported activity also changed sharply. Amazon recorded an attack attempt on October 17. Cloudflare said hacking attempts ran from thousands before the upgrade to millions afterwards. Those figures describe attempts observed by Cloudflare, not confirmed successful breaches, so they should not be read as a count of compromised websites.

The NCSC was investigating the first signs of successful hacks reported through its international network. It said there was no sign yet of abuse involving Dutch websites and was checking the reports. Meanwhile, several governments closed sites or issued warnings, showing the pressure created by the vulnerability's scale.

The article does not explain precisely what attackers could do after exploiting the PHP vulnerabilities. It reports the first signs of successful hacks on websites and describes the weaknesses as serious. In general, a successful software exploit can give an attacker unauthorised access or the ability to alter a service, but those specific outcomes are not confirmed here.

The clearest evidence is the activity observed around the disclosure. Amazon reported an attack attempt on October 17. Cloudflare saw attempts from thousands before the upgrade and millions afterwards. The NCSC received signals through its international network and began checking whether reports of successful hacks were accurate.

The possible consequences were serious enough for major organisations to act defensively. Government, healthcare, and news websites temporarily went offline while awaiting the upgrade. The NCSC warned that the situation could rapidly worsen. At the same time, it said there was no sign of abuse involving Dutch websites, and AP had received no linked breach reports.

Websites temporarily went offline because they were waiting for a PHP upgrade that addressed the exposed weaknesses. Keeping a site online while its underlying software may be vulnerable can leave it open to attack. Taking it offline reduces public access and service availability, but it can also reduce immediate exposure while administrators prepare a fix.

The article names government, healthcare, and news sites among those affected. Dutch News also went offline temporarily. The PHP developers announced that they would issue an upgrade by Wednesday afternoon, giving organisations a specific remedy to wait for rather than continuing with the vulnerable software.

The disruption showed how widely the risk spread. The Netherlands closed many sites and issued warnings early on Wednesday. Belgium, Germany, France, and Finland then did the same. The article does not say when every site returned, but it reports that the issue had become a global concern and that organisations were responding while upgrades were pending.

The PHP developers were responsible for producing the software fix. After details of the weaknesses were leaked on Monday, they announced an upgrade for Wednesday afternoon. Their response gave website operators a way to address the vulnerable code, although organisations still had to wait and act.

The NCSC monitored the wider threat. It received signals from its international network about possible successful hacks, investigated whether those reports were accurate, and said there was no sign of abuse involving Dutch websites. Cloudflare provided an important view of attack activity, reporting a rise from thousands of attempts before the upgrade to millions afterwards.

Governments acted to limit risk and alert organisations. The Netherlands closed many sites and issued warnings early on Wednesday. Belgium, Germany, France, and Finland followed. The Dutch privacy watchdog AP added a data-breach check, saying it had received no reports linked to the vulnerabilities. Together, these responses showed a coordinated, international effort.

A software vulnerability is a weakness that attackers may try to use. When detailed information about it becomes public, attackers can examine the same information as defenders. That creates a dangerous window: websites may still run the vulnerable code while attackers already know where to focus. The article reports that details were leaked on Monday and hacking attempts increased afterward.

The timeline illustrates the risk. Amazon reported an attack attempt on October 17, and Cloudflare saw attempts rise from thousands before the upgrade to millions afterwards. The article does not prove that the leak caused every attempt, but it shows why disclosure and patching created urgency. The PHP developers announced an upgrade for Wednesday afternoon.

An upgrade reduces danger by replacing or correcting the vulnerable software. Organisations still need to install it and check their systems. Some sites went offline while waiting. The NCSC continued investigating, and the international response showed that rapid patching mattered as the situation became global.