UK and global organisations assess leaked PHP flaws as attacks emerge

Governments and major companies are working to find and fix vulnerabilities in PHP, a programming language used by many websites, after details of the flaws leaked online. The warning triggered a global cyber-security response because attackers may be able to exploit the weaknesses to reach servers and access sensitive information.

Amazon reported attempts against its systems on 17 and 21 October, including activity before the official warning was released; it said the later attempts appeared to involve multiple actors. The flaws had gone undetected for at least a decade, and cyber-security firm Wiz estimates that roughly 70% of the internet may be affected, a figure the BBC could not independently verify. Some organisations, including the Dutch cyber-security agency and Finland’s government, took services offline as a precaution.