Technology

Millions of attack attempts target PHP flaw worldwide

CloudFlare counted tens of thousands within 45 minutes of disclosure and Britain pulled 32 government services offline, NCSC calls the scale unprecedented while reporting no successful hacks

Images

A page on the BBC website temporarily unavailable due to the issue. Photograph: Yui Mok/PA A page on the BBC website temporarily unavailable due to the issue. Photograph: Yui Mok/PA theguardian.com
The race to fix huge PHP flaw at the heart of the internet - The Latest The race to fix huge PHP flaw at the heart of the internet - The Latest theguardian.com
A notice on the National Cyber Security Centre website warned of a critical security issue affecting PHP. Photograph: Yui Mok/PA A notice on the National Cyber Security Centre website warned of a critical security issue affecting PHP. Photograph: Yui Mok/PA theguardian.com

CloudFlare encountered tens of thousands of attempts to exploit the PHP vulnerability within 45 minutes of its disclosure on Wednesday, rising to hundreds of thousands within two hours and to millions since, chief executive Matthew Prince said. Governments and companies worldwide took websites offline to prevent attacks and install patches, and Britain pulled 32 government services out of operation, cybersecurity minister Liz Lloyd told parliament.

PHP underpins roughly 70 percent of the world's websites. The US National Security Agency warned that the flaw could allow attackers to seize control of web servers, steal sensitive data, disrupt services and move deeper into networks. Britain's National Cyber Security Centre has sent 50,000 alerts to affected organisations and described the scale of the vulnerability as "unprecedented". Ciaran Martin, the NCSC's former chief executive, called the flaw "very bad" and "the most serious vulnerability discovered for five years", and former GCHQ chief David Omand warned that Russia and China could look to exploit it.

No successful hacks have been reported to the NCSC as a result of the flaw. Ryan Austin, the researcher credited with discovering it, said that "at the moment it doesn't look like exploitation has taken off or been widespread". The British Chambers of Commerce said the flaw was not yet causing firms significant difficulties, and Downing Street said some limited services may be temporarily offline but that this did not mean they had been hacked.

The concern is concentrated where patching is hardest. The NCSC flagged systems used by schools, local governments and charities, which may lack dedicated cybersecurity support to execute the fix. Sites reportedly affected include the Internet Archive, Wikipedia and 4Chan, and the BBC's Traitors website was down on Thursday. The UK government declined to name affected services, saying they were being reviewed, updated and brought back online.

The patch does not reach everyone. The NCSC says it will not work for organisations running older systems, which will have to be replaced.