The flaw was discovered in PHP, a programming language widely used in the development of websites and online services. According to the BBC, the vulnerability exposes affected systems to the risk of cyberattacks.

Security patches have yet to be applied to approximately 90 percent of the vulnerable systems; however, there is currently no evidence that the flaw has been exploited to carry out attacks or breach systems. Experts note that while about 90 percent of the vulnerable systems remain unpatched, no confirmed exploitation has been observed so far.

Two serious vulnerabilities in PHP were identified with the help of artificial intelligence. These flaws could allow an attacker — under certain conditions — to execute unauthorized commands on a web server and gain access to sensitive information.

On October 21, the maintainers of PHP released security updates to address these vulnerabilities. However, the situation has proven to be more concerning than initial reports suggested.

“I haven’t seen a scenario of this nature for a long time.”

— Satya Nadella, CEO of Microsoft

According to the news agency Reuters, Cloudflare recorded millions of attempted attacks within hours of the details regarding these vulnerabilities becoming public. A report by Wired indicates that attempts to exploit these flaws began as early as October 17 — even before the security patches were released.

According to the British government, 32 government services were temporarily shut down as a precautionary measure, while four others were partially disabled. Officials clarified that the suspension of these services does not imply that they have been hacked. There are also reports of certain online services being affected in other countries, including Canada. Finland also temporarily suspended its government web services as a precaution.

Microsoft CEO Satya Nadella expressed concern over the situation, noting that he had not seen a scenario of this nature for a long time. Cybersecurity agencies have instructed website administrators to immediately install the latest security updates and increase the monitoring of their systems.

The UK’s National Cyber Security Centre has advised that if immediate protection cannot be ensured, affected systems should be temporarily taken offline until they are fully secured.