PHP patch rush strains IT teams as false hacking claims add to pressure

System administrators and security specialists have spent the past two days racing to secure websites built on PHP after two critical flaws were disclosed in the widely used programming language, BBC News reports. Workers involved describe heavy pressure, little sleep and a flood of worried clients. They also say misleading claims about hacking activity made the response harder.

An urgent fix for millions of sites

PHP runs millions of websites. After the vulnerabilities came to light, national cyber-security authorities told IT teams to install a security update quickly or take affected websites and servers offline. The PHP Foundation, which manages the language, released its fix at 15:00 BST on Wednesday, and organisations then rushed to apply it.

Microsoft chief executive Satya Nadella told a conference he had not seen a comparable emergency "in a long, long time".

The work was not always simple. Administrators reported that many PHP installations are old versions that no longer receive support, so some web applications have needed code changes or rebuilding rather than a straightforward update. Others noted that the disclosure came with little warning, leaving almost no time to prepare. Some also worried that the patch itself could cause new problems, a familiar risk with software updates.

Rumours outpaced the evidence

Details of the flaw leaked early, and rumours spread that criminals were already exploiting it. Security experts now question those claims. One major security firm said attackers had a working proof-of-concept exploit and later withdrew the statement. Cloudflare and AWS warned of millions of hacking attempts every hour, but there is no evidence so far of large-scale data breaches or attacks.

Attackers have reportedly tried to use AI to build exploits, though none appear to work at scale for now. AI tools were also used to find the PHP flaws, which had gone unnoticed by human researchers for decades. People in the industry expect AI-assisted discoveries like this to become more common. Some warn that alarmist messaging could cause "alert fatigue" and leave teams slow to react when a truly exploitable flaw appears.

What it means for website owners

Anyone who runs a site on PHP, directly or through a hosting provider, should check that the security fix has been applied and find out whether their PHP version still receives updates. The episode shows the value of keeping software current, knowing who maintains a site, and relying on official advisories rather than unverified reports when a security alert breaks.