Hackers fire off millions of attacks at a PHP flaw that touches most of the web as site owners race to patch

A pair of security holes buried for years inside PHP, the programming language behind roughly seven in 10 websites on Earth, has set off a worldwide scramble. Since the flaws became public on Wednesday, criminals have thrown millions of break-in attempts at sites that have not yet installed the fix.

The head of a major internet security and delivery company said his network logged tens of thousands of attack attempts in the first 45 minutes after the problem was revealed. By Thursday he put the running total in the millions.

The bug, which researchers have nicknamed PHP2Shell, chains two weaknesses together. In the wrong hands it can let an outsider seize a web server, plant malicious software, copy customer records or knock a site offline altogether.

Found with help from AI

A cloud security firm working with an artificial intelligence model uncovered the problem and kept quiet until a repair was ready. The group of developers who maintain PHP pushed out two patches on Wednesday along with step by step update instructions and urged anyone running the language to install them immediately.

The researchers said the weak spots had been sitting in the code for a very long time. Turning them into a working attack took a chain of steps so complicated that people alone had struggled to pull it off. The AI tool shrank that hurdle dramatically, which is exactly why defenders are worried that attackers can now move just as fast.

Security experts say that window between a fix going out and the moment every site actually applies it is where the real danger lives. Plenty of smaller site owners may not even realize they run PHP under the hood.

Governments pull sites offline

The FBI's cyber division told organizations that cannot patch right away to take their websites down temporarily rather than leave them exposed. The National Security Agency asked operators to stay on high alert over the coming weeks.

Overseas the response was even more dramatic. Dozens of government services in Britain and Finland went dark this week while crews updated servers and a number of local government sites in France were briefly pulled as well. Japan's prime minister, Sanae Takaichi, issued an urgent call for everyone to act and said shutting a site for a while is a reasonable way to cut the risk if a patch cannot be applied quickly.

What it means for you

Simply visiting a site that runs PHP does not put your phone or computer at risk. The bigger concern is the personal details stored by online shops, booking services and other accounts. If one of those sites is breached, names, emails, home addresses and birth dates could be exposed.

Experts say there is no need to stop shopping or browsing online. They do recommend watching closely for suspicious emails and texts in the weeks ahead, using unique passwords and turning on two step sign-in wherever it is offered.