British cyber officials are racing to determine whether government services still run vulnerable versions of PHP after researchers disclosed critical flaws in the scripting language that underpins vast swaths of the public and private web. The National Cyber Security Centre told operators that if they cannot patch immediately, they should consider taking affected systems offline until fixes are in place.
What broke
PHP maintainers released emergency patches on Wednesday for two core vulnerabilities that security researchers said could let attackers execute code on servers without valid credentials. The bugs affect PHP itself—not a single vendor plugin—meaning any site that processes dynamic pages through PHP could be at risk, from small council portals to large e-commerce stacks.
OpenAI said its models helped discover the flaws during a coordinated disclosure period, and Cloudflare chief executive Matthew Prince posted that exploit attempts surged from tens of thousands within 45 minutes of public announcement to millions shortly afterward. That velocity is why NCSC’s guidance mirrors parallel warnings from EU and Australian agencies: patch, or isolate.
UK government response
A UK government spokesperson said departments are working to identify potential exposure across online services and urged all organisations to follow NCSC advice. The centre’s statement, published alongside international partners, said immediate remediation might not be feasible for every legacy stack, in which case disconnection is preferable to leaving a remotely exploitable admin path on the internet.
Cyber-security professor Alan Woodward told BBC Radio 4’s Today programme that roughly 30 million websites could be affected globally and that successful exploitation would let attackers steal data, pivot inside networks, or plant persistent backdoors. WordPress and Wikipedia—both heavy PHP users—were cited as examples of the ecosystem’s breadth, though neither reported breaches on Thursday morning.
Private sector moves
Amazon said its threat intelligence team detected targeting on Saturday and automatically restricted malicious scanning once technical details became public. The company described further exploitation attempts after the embargo ended, underscoring that automated defences are buying time but not replacing patches.
Japanese and European public bodies have already suspended portions of their sites as a precaution, a step several UK councils may emulate if shared hosting providers cannot certify patched runtimes before the weekend. Banks and insurers that rely on PHP-backed customer portals face reputational as well as technical risk if login flows stay live on unpatched containers.
What IT teams should do today
NCSC recommends verifying version numbers, deploying vendor patches, rotating secrets where compromise cannot be ruled out, and monitoring web logs for anomalous POST traffic. For teams without a maintenance window until night hours, reverse proxies and web application firewalls may blunt some probes but are not a substitute for upgrading PHP.
Regulators have not announced UK-specific enforcement actions, but the incident is likely to feed ongoing Financial Conduct Authority and Information Commissioner’s Office expectations that boards prove they understand “critical third-party” software—not just cloud contracts. Until patch rates rise, Britain’s exposure will be measured in how many .gov.uk and NHS endpoints still answer on vulnerable builds.