Threat Intelligence
Amazon and governments take websites offline after PHP flaw leaks
A critical flaw in PHP led Amazon and several governments to take websites offline after details leaked online. Attackers targeted Amazon's systems before a fix was ready.
Ross Grant2 min read
The short version
A serious security problem was found in PHP, a programming language used by many websites. Details of the flaw were leaked before a fix was ready, so attackers tried to break into systems, including Amazon's. As a result, Amazon and several government websites took services offline to protect themselves. Many organisations are still working to understand if they were affected.
By the numbers
- 70%Estimated share of the internet affected (unverified)BBC
- 10+ yearsTime the PHP flaws reportedly went undetectedBBC
What happened?
A critical flaw in PHP was leaked online before a fix was ready, leading Amazon and several government websites to take services offline as a precaution. Attackers targeted Amazon's honeypot systems on 17 and 21 October, using different methods. The US and other governments advised taking down websites if a fix could not be applied immediately. The flaw had reportedly gone undetected for a decade.
Who is affected
Amazon reported attacks targeting its systems, specifically a decoy or "honeypot" server, on 17 and 21 October. The BBC reports that the Office for Budget Responsibility, Edinburgh and Oxford council websites, and several BBC programme sites (including Doctor Who and The Traitors) were taken offline as a precaution. The Dutch cybersecurity agency, Finland's government, and Wikipedia also took down parts of their web services. According to cybersecurity firm Wiz, about 70% of the internet could be affected, but the BBC could not independently verify this figure. The US and other governments advised organisations to take websites offline if they could not apply a fix immediately. BBC (opens in a new tab)
How the flaw works
The vulnerabilities are in PHP itself, not in the applications or their configurations. The US National Security Agency (NSA) said these flaws can give attackers direct access to a server's file system or database. This could let them steal sensitive data, disrupt services, or move further into a network. The PHP flaws reportedly went undetected for at least a decade. BBC (opens in a new tab)
How the attack worked
Amazon's security chief, CJ Moses, said an anonymous internet address tried to exploit the flaw on a honeypot server on 17 October. After details of the vulnerability leaked on social media (before the planned public disclosure and patch), further attacks targeted Amazon on 21 October. The attackers used different payloads and anonymisation methods, suggesting multiple groups were involved. Moses noted that AI tools have made it much faster for attackers to act once technical details are public, shrinking the window from months to days or even hours. BBC (opens in a new tab)
The response
The PHP Foundation had planned to release details and a patch later in the month, but the leak forced organisations to act quickly. Many took their websites offline as a precaution, following advice from governments and security agencies. The NSA and others warned that immediate action was needed to prevent exploitation. OpenAI called this one of the most impactful security issues in recent memory. BBC (opens in a new tab)
Is there a fix?
At the time of the attacks and website shutdowns, a complete fix was not yet available. The PHP Foundation had intended to release a patch later in the month, but the leak accelerated the timeline and forced emergency responses. BBC (opens in a new tab)
Claimed vs confirmed
- Unconfirmed
Roughly 70% of the internet is affected by the PHP flaw.
Cybersecurity firm Wiz estimated this, but the BBC could not independently verify the figure.
- Unconfirmed
Websites for BBC programmes went offline due to the PHP flaw.
The BBC reports these sites are offline but has not confirmed a direct link to the PHP flaw.
Why it matters
PHP runs a large part of the internet, so a flaw in its core can put many websites and their users at risk. The leak of technical details before a fix was ready let attackers move quickly. This incident shows how fast threats can spread when details are made public, especially with the help of AI tools.
Key points
- A critical PHP flaw was leaked before a fix was ready, leading to attacks.
- Amazon and several government websites took services offline as a precaution.
- The flaw could let attackers access sensitive data or disrupt services.
- AI tools are speeding up how quickly attackers exploit new vulnerabilities.
- Many organisations are still assessing if they were affected.
