Websites across world hit by millions of attempts to exploit PHP code flaw

A page on the BBC website temporarily unavailable due to the issue. Photograph: Yui Mok/PA View image in fullscreen A page on the BBC website temporarily unavailable due to the issue. Photograph: Yui Mok/PA Websites across world hit 70% of sites has led governments and companies to pull sites offline to patch fault Tell us: have you been affected ? What is PHP, and how bad is the computer language flaw causing website shutdowns globally? Websites around the world have been hit a recently discovered vulnerability in their code, cybersecurity companies have said, as the US warned the flaw could allow attackers to take control of web servers, steal data and disrupt services. The problem in the PHP programming language, which underpins about 70% of the world’s websites, emerged on Wednesday causing governments and companies to pull their websites off the internet before they could be attacked and so they could patch the fault. What is PHP, and how bad is the computer language flaw causing website shutdowns globally? In the UK, 32 government services had been taken offline, the cybersecurity minister, Liz Lloyd, told parliament. She said this “largely resulted from precautionary measures” while updates were applied. Downing Street said no public-facing critical services had been affected and “some limited services may be temporarily offline” but this did not mean they had been hacked. The race to fix huge PHP flaw at the heart of the internet - The Latest The website for the BBC’s Traitors was one of those that was down on Thursday, while the government declined to name the affected sites, saying services were being reviewed, updated and coming back online. The UK’s National Cyber Security Centre (NCSC) sent out 50,000 alerts to affected organisations, but said it had no reports of successful hacks as a result of the flaw. Other sites reportedly temporarily affected included the Internet Archive, Wikipedia and 4Chan. The vulnerability sparked particular concern about the ongoing vulnerability of systems used by schools, local governments and charities, which may not have dedicated cybersecurity support to execute the fix. The NCSC said the scale of the vulnerability was “unprecedented” and the patch would not work for some organisations running older systems, and these would have to be replaced. The British Chambers of Commerce, which represents thousands of employers, said it was not yet causing firms any significant difficulties. Ciaran Martin, the former chief executive of the NCSC, described the flaw as “very bad”, saying that while most internet software vulnerabilities did not matter, this was “the most serious vulnerability discovered for five years”.