UK works to assess exposure after global PHP flaw warning

The UK government is working to identify any potential exposure in its online services after critical cyber‑security flaws were found in PHP, the language that powers many websites, according to the BBC.

PHP is an open‑source scripting language that has been used on the internet for more than 30 years. The PHP Foundation said the flaws sit in memory management and error handling, parts of PHP that nearly every request touches, according to the Guardian.

The two vulnerabilities, dubbed PHP2Shell by security vendor Hadrian, can corrupt memory through a request and give an attacker a direct path to a server’s file system or database, according to the US National Security Agency and the Guardian.

Governments and companies, including Amazon, are rushing to protect systems that use PHP before hackers can exploit the flaws. The UK National Cyber Security Centre urged organisations to apply fixes or take systems offline if immediate remediation is not feasible, according to the BBC.

An estimated 70% of websites use PHP, and the PHP Foundation said the vulnerabilities could affect some 30 million sites, according to the Guardian and BBC. Patches are already available, and the PHP Foundation has worked with AI models to scan its code, according to the Guardian.