'Days or hours': Cyber expert's dire PHP warning as companies race against time to patch systems

A hidden flaw in the code powering most of the internet has triggered a global scramble, as governments and firms race the clock.

Governments and companies are in a race against time to update their systems after a major cybersecurity flaw was exposed in a popular programming language called PHP.

The system helps run 70 per cent of the world’s websites, from online stores and news outlets to government services, according to Wiz Research, one of the cybersecurity firms that found the two flaws .

Experts have warned it may take months to understand the full extent of the damage wrought by hackers exploiting the vulnerabilities.

In the UK, 32 government services were taken offline while four remained partially unavailable, according to the country’s tech minister, Baroness Lloyd of Effra.

She said the move “largely resulted from precautionary measures” to protect the system while security updates are pushed through.

The UK government did not specify which services had been pulled but it said no public-facing critical services had been affected.

The BBC spoke to one mechanic in Wales who said he was unable to properly access the country’s online car registry database.

Meanwhile, the boss of a global cloud platform providing internet infrastructure and web security services to millions of websites, Matthew Prince, said Cloudflare witnesses “thousands” of attempts to exploit PHP weaknesses across its network in the 10 hours before it was publicly announced.

“That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within two hours, and millions now,” he said.

Amazon said hackers tried to exploit the flaws but said its websites were operating as normal.

The website of a Dutch agency specialising in cybersecurity, Finland’s government and parts of Wikipedia were taken temporarily offline. They returned to service on Thursday.

But a number of sites appeared to have been taken offline on Thursday, as operators rushed to check if PHP might be running within their systems or if any patches were required, the BBC reported.

In France, telecommunications company Orange said it cut off access to certain services globally while it carried out security updates.

Cybersecurity researchers warned companies using PHP were not implementing security quick enough.

“The window to respond has shrunk dramatically,” said Matt Hull, VP of cyber intelligence and response at global cyber security company NCC Group.

“A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours.”

How is this affecting Australia?

Australian government websites including the cyber defence agency and the ABS were among hundreds around the world shut down Wednesday night .

Sites pulled offline for urgent security updates ranged from official government portals and local councils, to gaming and commerce platforms, to popular internet forums like Something Awful and notorious message board 4chan.

The US National Security Agency (NSA) has advised all organisations using PHP to either patch immediately or pull systems offline.

“These vulnerabilities often provide a direct path to the server’s file system or database,” the NSA said in a statement.

“If an immediate update is not feasible, it is recommended that organisations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.”

The Australian Signals Directorate (ASD) said in a post on X that organisations and individuals using the program should prepare to update and apply patches.

The ASD’s post included a link to “read the full alert” on the agency’s own cyber.gov.au website — but the website had been taken offline.

“We are aware of an outage that may be affecting Government websites, including the ASD said in a follow-up post.

“Organisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.”

The cyber.gov.au website was back online by mid-morning on Thursday.

The ASD’s Australian Cyber Security Centre (ACSC) “is currently not aware of active exploitation related to these vulnerabilities”, the notice said.

Affairs Minister Tony Burke has been contacted for .

Attackers could use the security flaws to take over web servers without needing a password.

Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.