IT Workers Scramble to Patch Critical PHP Flaw in Millions of Websites
UK and Mauritius administrators describe days of client pressure, takedown requests and little sleep as two serious PHP flaws are fixed
By AXY Tech Desk ·
Key points
- Two critical flaws were found in PHP, a programming language that powers millions of websites, prompting urgent action from national cyber-security authorities.
- Authorities urged IT teams to download a security fix urgently or take websites and servers offline.
- UK system administrator Adam Mudd said clients wanted sites taken offline as a precaution, which made coordinating fixes much harder.
- Loganaden Velvindron, an IT administrator in Mauritius, said his team has been flat out since realising how much software relies on PHP.
- IT workers say misinformation and panic have made the emergency worse, and smaller sites may be the hardest to secure.
IT workers who have spent the last 48 hours fixing a serious weakness in PHP say the job has been relentless. The BBC spoke to IT and cyber experts about their struggles to update systems in that time. The emergency centres on two critical flaws in PHP, a programming language that powers millions of websites. National cyber-security authorities have urged IT teams to download a security fix urgently or take websites and servers offline.
Microsoft chief executive Satya Nadella has also weighed in. He said he has not seen anything like the PHP emergency "in a long, long time". Speaking at a conference, he addressed the teams doing the work on the ground. "It was a long day and a long night, I know, for all the IT and security folks," he said.
The view from the front line is far less abstract. Adam Mudd, a UK-based system administrator, said it has been relentless. He told the BBC he had never received so many messages from people worried about their websites. He works early and does not finish until 22:30 BST, and he says he has lost a huge amount of sleep trying to secure his customers' systems.
Two Flaws, One Very Popular Language
PHP is a server-side scripting language. That means it runs on the computers that host a website rather than on the device of the person looking at it. When a visitor requests a page, the server runs the PHP code to build that page and sends the result back. The language has been in use for decades. It was first released in 1995 and is free to use, which helped it spread across everything from personal blogs to large commercial platforms.
WordPress, one of the best-known tools for building websites, is built on PHP. That single fact explains why a weakness in the language reaches so far. A flaw in PHP is not confined to one company's product. It can affect any site, server or application that runs the vulnerable code, and many of those sites are run by people who are not full-time technologists.
The BBC report describes two critical flaws. In plain terms, a critical flaw is a weakness serious enough that someone with bad intentions could use it to reach systems they should not be able to access. The usual fix is a patch, a software update that closes the gap. A patch only helps once it is installed, and every server running the affected code has to be updated separately. That is why the warnings from national authorities were so direct. Install the fix quickly, or take the affected sites and servers offline until they can be secured.
Why Taking a Site Offline Is a Hard Call
Taking a website down is the cautious option, but it is not free. A shop cannot take orders while it is offline. A news site cannot publish, and a booking page stops working for the customers trying to use it. For a small business, even a short outage can mean lost sales and frustrated customers.
That trade-off sits at the centre of the work Mudd describes. He said "the biggest challenge has been juggling clients who want their sites taken offline as a precaution, while trying to coordinate updates and fixes across countless different setups." Some clients want the safest possible response, which means pulling their sites down immediately. Others need to keep trading. The administrator has to explain the risk, decide what is practical for each setup and then bring each site back online without introducing new problems.
Mudd also made a remark that shows how much of the job is not technical. "Sometimes it takes me longer to take a website down than to fix the PHP problem," he said. Each client has a different hosting arrangement, a different level of technical knowledge and a different tolerance for downtime. Every conversation about whether to switch a site off takes time that never shows up in a patch note.
When a Team Realises How Much Software Relies on PHP
In Mauritius, IT administrator Loganaden Velvindron said he has also been flat out. He said his team's workload grew once they realised just how much software relies on PHP. His account points to a problem many organisations face during an incident like this one. Software that seems unrelated to a web language may still depend on it, sometimes several layers down.
For an administrator, the first job is often finding out where the affected code is running at all. That means identifying which servers and applications use PHP, which versions are installed and which systems depend on them. Only then can teams decide which fixes to apply first. The task can be as demanding as the update itself, especially where records are incomplete or where a site was set up years ago and has been running quietly ever since.
The pattern in both accounts is familiar to anyone who has managed a busy website. The emergency is not one task repeated once. It is hundreds of separate checks, each one needing a decision about timing, risk and communication.
Rumours and Panic Add to the Strain
The experts who spoke to the BBC said misinformation and panic have made things a lot worse. When a serious flaw is widely reported, people who are unsure whether their site is affected may act on rumour. Some of those actions can create new problems of their own. A site taken offline unnecessarily loses visitors and income. A site left running an unpatched version stays exposed. Both outcomes can follow from confusion about what the flaw is and who needs to act.
This is why clear guidance matters so much in the early hours of an incident. Administrators need to know which versions are affected, what the fix is and how urgent it is for their particular setup. Without that information, every message from a worried client becomes a new emergency to sort out. Mudd's experience of a sharp rise in worried messages suggests how quickly that pressure can build when people are not sure what to do.
What Could Happen Next for Smaller Sites
The next test is how quickly fixes reach the many smaller sites that do not have a dedicated IT team. Large organisations usually have staff who can apply updates quickly and check the results. The owner of a single blog or a small online shop may depend on a hosting provider, a freelance developer or no one at all. If those sites are not patched, the weakness can stay in use long after bigger organisations have moved on.
For people like Mudd and Velvindron, the work is unlikely to end with a single update. Checking that every affected site has been secured, bringing offline sites back safely and answering follow-up questions from clients could all take more time. The emergency is likely to end only when each affected site is confirmed as secure. That depends on thousands of individual decisions, made by people who have been working long hours under pressure.
For ordinary readers, the practical question is simple. If you run a website, or use a service built on PHP, it is worth checking with your host or developer whether the fix has been applied. Whether a site is affected depends on the software and version it runs, so the safest route is to ask the people who manage it rather than act on rumour. The administrators' accounts make one thing clear. The people keeping the internet's smaller corners running are carrying much of the cost of this emergency, and their work is what decides how long it lasts.
Questions and answers
What is the PHP security flaw?
Two critical flaws were found in PHP, a programming language that powers millions of websites. National cyber-security authorities urged IT teams to download a security fix urgently or take websites and servers offline.
Why are some websites being taken offline?
Authorities urged teams to take sites and servers offline if they could not install the security fix quickly. Some clients have also asked for their sites to be taken down as a precaution while updates are coordinated.
Who is affected by the PHP emergency?
Because PHP powers millions of websites, the problem reaches businesses, blogs and other sites of all sizes. IT workers such as UK system administrator Adam Mudd and Mauritius-based IT administrator Loganaden Velvindron have been handling the response.
What did Satya Nadella say about the PHP emergency?
Microsoft chief executive Satya Nadella said he has not seen anything like the PHP emergency "in a long, long time". He told a conference it was a long day and a long night for IT and security staff.
Topics: PHP, cyber security, website security, Adam Mudd, Loganaden Velvindron, Satya Nadella, software updates
Sources: BBC Technology