UK working to identify exposure after global cyber-security warning

The UK government says it is trying to work out whether its online services were exposed after critical flaws were found in PHP, the software that helps run a huge share of the web. The warning has triggered a broad scramble, with governments and companies including Amazon moving fast to protect systems before attackers can get in.

The bugs were first spotted by AI, and officials in the UK, EU and Australia quickly told PHP users to patch them. The UK’s National Cyber Security Centre said that if a fix cannot be applied right away, organisations should think about taking the system offline until the problem is fully dealt with. A government spokesperson also called on organisations of every size, public and private, to follow the guidance.

Amazon says it saw multiple attempts to exploit the issue. One came on 17 October, when an anonymous internet address tried to hit weaknesses in one of its decoy systems, which security chief CJ Moses described as a honeypot. Amazon later said the use of an anonymous IP suggested a threat actor was involved, but it was not clear how those actors learned about the vulnerabilities.

Then the details leaked on social media on Tuesday, before the embargo on the warning was lifted. Amazon says it saw more attacks on 21 October, after the leak but before the warning went public. Moses said the different payloads and anonymisation methods suggested more than one actor was involved. He also said AI is letting more actors move within hours or even minutes once technical details are out.

The PHP Foundation had planned to release the discovery later this month with a full patch. Instead, the issue broke open early. The flaws went undetected for at least a decade, and Wiz has estimated that roughly 70% of the internet is affected, though the BBC says it cannot verify that figure independently.