A critical security flaw in PHP, the programming language behind millions of websites, has triggered an urgent global patching effort — and a wave of misinformation that experts say has made the response harder than it needed to be.

Two critical vulnerabilities were found in the system, prompting national cyber-security authorities to urge IT teams to install a security fix immediately or take websites and servers offline. The PHP Foundation, which manages the language, released its patch on Wednesday at 15:00 BST, and administrators scrambled to apply it.

UK system administrator Adam Mudd said the past 48 hours had been "relentless," with more messages from worried website owners than he had ever handled. The hardest part, he said, was juggling clients who wanted their sites taken offline as a precaution while coordinating updates across countless different setups. "Sometimes it takes me longer to take a website down than to fix the PHP problem," he said, adding that he had lost a huge amount of sleep and worked until 22:30 BST to secure customers' systems.

In Mauritius, IT administrator Loganaden Velvindron said many PHP versions in use are end-of-life, forcing his team to rebuild web apps and change code in some cases. He said the vulnerability announcement arrived without much time to prepare.

Jon Jones, technical director at a digital advertising company, described the patch launch as "the race was on," while noting the nerves that come with any software update that might cause fresh problems.

The rush was fueled partly by a leak of details about the flaw and rumours that cyber-criminals were already attacking. Those rumours are now being questioned. UK cyber expert Daniel Card said the industry was "flooded with rubbish intel about hackers being out there actively with working Proof of Concept methods." One major security firm issued a warning that hackers had a working PoC, then retracted it. Despite warnings from Cloudflare and AWS of millions of hacking attempts per hour, there is no evidence of large-scale data breaches or cyber-attacks.

Experts agree the vulnerabilities are serious on paper. Some worry the messaging around them risks "alert fatigue" — a problem if a fully exploitable flaw emerges later. The IT workers the BBC spoke to expect such serious flaws to be uncovered more often as AI tools grow better at finding them.

Source: BBC News