Millions of Exploit Attempts Target Critical PHP Code Flaw

Websites worldwide have been hit by millions of attempts to exploit a flaw in PHP, the programming language that underpins roughly 70% of the web, according to The Guardian. The vulnerability has prompted governments and companies to pull sites offline in order to patch the fault.

The scale of the attempted exploitation underscores the breadth of PHP's footprint across internet infrastructure. Because PHP powers such a large share of websites, a flaw in the language creates a wide potential attack surface, and the volume of attempts reported indicates automated scanning and exploitation efforts are already widespread.

The decision by governments and companies to take sites offline reflects the severity with which the flaw is being treated. Pulling services offline is a disruptive step, typically taken when patching cannot be completed quickly enough or when the risk of exploitation is judged to outweigh the cost of downtime.

The incident highlights the concentration risk embedded in widely used open-source software components. A single flaw in a language used by the majority of websites can require coordinated responses across public and private sectors simultaneously.

For investors, the event is a reminder that operational disruption from software vulnerabilities can affect organisations regardless of sector, and that remediation costs and downtime can follow quickly after disclosure. The source report does not specify which versions of PHP are affected, the technical nature of the flaw, or the identities of the governments and companies that took sites offline.