This Week's PHP Scare Is a Taste of What's Coming

If you tried to get onto a council website or a BBC programme page on Wednesday and found it had gone dark, you might have run into one of the biggest web security scrambles in years. And my honest take? We need to get used to days like this.

So what actually happened?

Researchers found two serious flaws in PHP. If you've never heard of PHP, you're not alone, but you've almost certainly used it today. It's the programming language running quietly underneath a huge chunk of the internet, including WordPress, Drupal and Joomla. The security firm that found the flaws reckons around 70% of websites use it. The BBC said it couldn't verify that figure, but even half of that would be a lot of websites.

The flaws could let someone take control of a website's server without ever logging in. They could also let attackers read passwords, keys and other sensitive bits sitting in the server's memory. Not great.

The plan was to fix it quietly and announce it later. Then details leaked on social media on Tuesday, a fix was pushed out on Wednesday afternoon, and organisations around the world started pulling websites offline while they caught up. The Finnish and Dutch governments switched off some public services. The UK's National Cyber Security Centre told businesses to patch, or think about taking systems offline until they could. Edinburgh council's website and some BBC programme pages, including Doctor Who and The Traitors, went down too, although neither has confirmed that was the reason.

Here's the bit that matters: AI found it

These flaws had been sitting in PHP for more than ten years. Nobody had worked out how to use them because it was simply too complicated for people to do by hand. Then researchers pointed the latest AI tools at it. One of the teams said a single researcher did in a week what would previously have taken a world-class team months.

That's brilliant news for the people fixing things. Old, hidden problems are finally being found and sorted. But the same tools are out there for the people on the other side too, and that's the part we all need to sit with.

Why I think this is the new normal

There's a lot of old code holding the internet together. Code written years ago, by people who assumed certain things were too hard to break. AI is making "too hard" a lot less hard, very quickly.

So I think we're going to see more of this. More big "patch it now" moments. More websites and services going offline for a day while someone catches up. More headlines that sound scarier than they are for most of us, and now and then one that's every bit as bad as it sounds. I'm honestly not trying to frighten anyone here. If we expect it, we can plan for it, and it stops feeling like the sky is falling every time.

What you actually need to know

If you run a small business with a website, here's what I'd want you to take away from this week.

• You're probably using PHP without knowing it. If your website is on WordPress, it runs on PHP. Plenty of booking systems and online shops do too.
• Updating WordPress won't fix this one. The problem sits underneath WordPress, in PHP itself. Keep updating your plugins and theme because it's good housekeeping, it just doesn't solve this.
• Your host usually holds the key. On most hosting packages, the company you pay to host your site is the one that updates PHP. A lot of the big hosts moved quickly.
• Ask them one simple question: "Has the PHP running my website been patched for PHP2Shell?" If they can't give you a straight answer, that tells you something too.
• Older versions are a problem. The official fix only came out for newer versions of PHP (8.2 and up). If your site is on 8.1 or older, it's time to upgrade, and your host or web person can help with that.
• Don't install a random "fix". Steer clear of plugins or bits of code from forums claiming to sort this. The only proper fix is the official update.
• Change your passwords and switch on two-step login. Because the flaw could leak passwords from memory, it's sensible to change your website admin passwords and turn on two-factor authentication if you haven't already. Ten minutes, well spent.
• Have a plan for a day offline. Think about what you'd do if your website, booking system or a key tool went down for 24 hours. Who would you tell, and how would customers reach you? If you've got that answer ready, a day like this is just a bit of a pain.

If you want the full story, the BBC has a good write-up: Websites taken down worldwide as critical cyber-security update issued.

And if your team is using AI tools day to day, it's worth making sure they know the basics of using them safely. That's exactly what our AI and ethics training covers.