PHP Flaw Pushes Governments to Pull Websites Offline
Flaws that had sat in PHP for decades became public on Wednesday, and attackers moved within hours, the Guardian reported on 22 October. PHP is a programming language behind about 70 percent of the world's websites. The British government pulled services offline to install a fix; Wikipedia and the Internet Archive were reportedly affected too. The US National Security Agency warned attackers could seize web servers and steal data.
CloudFlare, a cybersecurity business, counted tens of thousands of exploit attempts in the 45 minutes after the announcement, hundreds of thousands within two hours and then millions, said its chief executive, Matthew Prince. In Britain, 32 government services went offline, mostly as a precaution, the cybersecurity minister Liz Lloyd told parliament. The National Cyber Security Centre, the UK's cyber defence agency, sent 50,000 alerts and had no reports of successful hacks. South Korea raised its private sector alert level, and China's industry ministry urged immediate upgrades.
How widely the flaw is exploited is disputed. Amazon Threat Intelligence reported broad exploitation; Ryan Austin, a researcher who helped find it, said it did not look widespread. CloudFlare saw thousands of attempts in the 10 hours before the announcement. The patch will not work on some older systems, which must be replaced, the National Cyber Security Centre said.
The National Security Agency said the risks require immediate patching across US government departments and agencies. Japan's prime minister encouraged businesses to patch or shut down their sites. In Britain, the government said affected services were being updated and coming back online, but named no date.
The cards of this story
from the video, click to enlarge
Well sourced and honest about disputed scope, with patching named as the response, but mostly describes a crisis and offers little on how to fix or prevent it.
The text gives concrete numbers and named sources, such as 32 UK services offline, 50,000 alerts and Cloudflare's attempt counts. It admits that the extent of exploitation is disputed and that older systems cannot be patched, and it keeps a sober tone. The solution is only a brief mention: patch or replace, with no timeline for services returning. The score would rise with more on how fixes work, what operators can do, and how such long-hidden flaws might be caught earlier.
AI assessment by fixed criteria. How we score →
