PHP patch panic: IT crews run on no sleep and a flood of bad intel
Two critical flaws in PHP, the code quietly powering millions of websites, sent IT teams into a 48-hour scramble — and the panic is only half the story. Microsoft's Satya Nadella says he hasn't seen anything like it 'in a long, long time.' Meanwhile, experts warn a flood of bad intel about rampaging hackers may be doing real damage.
The boss of Microsoft has seen a lot. Not this. Satya Nadella told a conference he hasn't witnessed anything like the PHP emergency 'in a long, long time,' calling it 'a long day and a long night' for IT and security staff everywhere. Two critical flaws in PHP — the programming language quietly powering millions of websites — triggered urgent alerts from national cyber-security authorities. Their message was blunt: download the fix, or take your sites and servers offline.
On the frontline, it has been brutal. UK system administrator Adam Mudd told the BBC the last 48 hours have been 'relentless,' with more worried messages than he has ever handled. He's juggling clients who want their sites pulled offline as a precaution while coordinating updates across wildly different setups — and sometimes, he says, taking a site down takes longer than fixing the actual flaw. In Mauritius, IT administrator Loganaden Velvindron found plenty of PHP versions running long past end-of-life, forcing his team to rebuild web apps and rewrite code from scratch.
The PHP Foundation shipped its patch, and the race was on. Jon Jones, technical director at a digital advertising firm, said the fix landing at 15:00 BST on Wednesday felt like a Hollywood action scene — exciting, but nerve-racking, since updates can break things too. Someone had leaked details of the flaw early, and rumours tore across the industry that cyber-criminals were already attacking.
Those rumours may have been noise. UK cyber expert Daniel Card told the BBC he was 'flooded with rubbish intel' about hackers armed with working proof-of-concept attacks. One major security firm pushed exactly that warning, then had to retract it. Cloudflare and AWS flagged millions of hacking attempts per hour, but there's still no evidence of large-scale data breaches or attacks. Government agencies piled on alerts too — even Japan's Prime Minister.
The flaws themselves were uncovered by AI, after decades of hiding from human researchers. Every IT worker the BBC spoke to expects serious bugs like this to surface far more often now that AI tools are so good at hacking. Mark Maunder, founder of WordPress security tool Wordfence, warned that overheated messaging risks 'alert fatigue' — a serious problem if a genuinely wide-open flaw lands. Hackers are already using AI to build attack methods, though nothing is working at scale yet. That could change soon.
TopicsPHP · PHP Foundation · Satya Nadella · Microsoft · Cloudflare · AWS · Wordfence · Daniel Card
Written by Paparazzi with AI. Not financial advice.