Millions of Exploit Attempts Target Critical PHP Code Flaw

Websites worldwide have been hit by millions of attempts to exploit a flaw in PHP, the programming language that underpins roughly 70% of the web, according to The Guardian. The vulnerability has prompted governments and companies to take sites offline in order to patch the fault.

The scale of the attempted exploitation underscores how widely PHP is deployed across public-facing websites and the operational disruption caused when a core component of that infrastructure requires emergency remediation. Organisations responding to the threat have chosen to remove affected sites from service rather than leave them exposed while fixes are applied.

The incident highlights the concentration risk inherent in the web's reliance on a small number of foundational technologies. A single flaw in a language used by the majority of sites can generate exploitation attempts at global scale within a short window, forcing simultaneous patching across public and private sector estates.

For investors, the event is a reminder that cyber risk is an operational continuity issue, not merely a compliance one. Entities that pulled sites offline face direct disruption to digital services, while the broader response effort points to sustained demand for vulnerability management, patching and security tooling. The source did not disclose the number of affected organisations, the identity of the attackers, or the financial cost of the disruption.

Attention now centres on how quickly affected operators can complete patching and restore services, and whether the volume of exploitation attempts persists once fixes are broadly applied.