Websites across world hit by millions of attempts to exploit PHP code flaw

A newly discovered flaw in PHP, the programming language used by about 70% of the world’s websites, has prompted organisations to take sites offline while they install a fix. The US National Security Agency warned that attackers could use it to take control of web servers, steal data and disrupt services, raising particular concerns for schools, local authorities and charities with limited cybersecurity support.

Cloudflare reported that attempts to exploit the flaw, known as PHP2Shell, rose from tens of thousands shortly after disclosure to millions; Amazon Threat Intelligence said it was being exploited in the wild. Some government sites and the BBC’s Traitors website were taken offline, with many government sites returning after patching. Researchers said the underlying weaknesses had existed for decades, but one expert cautioned that widespread exploitation had not yet been established; there was also concern that details emerged before the patch was ready.