Update to my earlier PHP2Shell post. The fallout from the two critical PHP flaws is now hitting governments. The Register reports that 32 UK government services are unavailable and four more are partly disrupted.
What’s new
- Tech minister Baroness Lloyd of Effra gave the figures in the House of Lords on Thursday. She said it “has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied.” The government says it isn’t aware of any confirmed compromise of central government systems, and later extended that to the wider UK public sector.
- The Office for Budget Responsibility took its website offline, with next week’s Budget looming. Peers also raised disruption to the DVLA and police services, and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet reportedly pulled services.
- It’s not just the UK. Government sites in Germany, France, Belgium, Finland and the Netherlands went offline as a precaution, along with Australia’s own cybersecurity agency website. The NSA urged organizations to patch or disconnect vulnerable systems.
- The NCSC told organizations to patch immediately or consider pulling affected systems offline, and sent 50,000 warnings to businesses and other organizations.
- OpenAI briefed the NCSC about one of the bugs last week so disclosure could be coordinated. Security firm Calif found one of the flaws using OpenAI’s GPT-5.6 Sol model, and Google’s Wiz separately found both with the help of AI tools.
- AWS says attackers were exploiting the flaws four days before they were publicly disclosed, and Cloudflare has recorded millions of attempts to weaponize them.
My take
Governments pulling sites offline instead of risking exposure tells you how serious this is. If you run PHP anywhere, finish the update, restart the PHP workers so the fixed code is actually running, and check that nothing public-facing is still on a vulnerable branch. My patching walkthrough is here, and the general checklist is here.
Have a blessed day! And Happy Hacking!
