School parents’ evenings schedule booking websites. Parts of Wikipedia and the Internet Archive. A handful of local councils. Websites across the internet are going dark, but not due to a cyber attack. It’s in an attempt to mitigate the risk of one, thanks to a fatal flaw in the system that’s used by 70 per cent of websites.
The culprit is PHP, a programming language that does much of the work behind the scenes when you visit a website – retrieving information from databases, processing forms and making everything from online shops to school booking systems function.
Two major flaws in the way PHP handles computer memory mean that hackers could potentially run their own code on affected servers without needing a password, giving them access to sensitive information. They could then steal data or even take over websites entirely. Both vulnerabilities have been rated 9.2 out of 10 for severity.
Fixes for the two issues were released on Wednesday, but website operators need to install them – and until they do, some have decided it’s safer to take their services offline altogether. As of midday Thursday, this included the government, as a UK minister confirmed that 32 government services were unavailable due to the global cyber-security issue.
A No 10 spokesperson said: “No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues.”
The incident comes just days after a Google Cloud outage took banks offline for a period of time, and highlights the precarious nature of our digital lives and the surrounding infrastructure, reliant on interconnected systems that can topple in an instant or can suddenly be found to have massive weaknesses.
And given we’ve seen banks and government websites go down – either accidentally or voluntarily this week – it is natural for people to start worrying about whether their cash is safe or not. Not for nothing does the government’s preparedness advice include keeping a small amount of cash at home as part of our emergency supplies.
A bank’s app going offline doesn’t mean the cash is gone, even if it does mean you’re unlikely to be able to access it for the duration of an outage. When it comes to cyber attacks, banks have multiple layers of protection, including user authentication and systems designed to detect suspicious transactions. Yesterday, the website Axios reported that sources had told them that some major U.S. banks were detecting unauthorised third-party AI agents operating inside customer accounts, with some agents attempting to take actions that appeared to be independent of user instructions. Banks are investing in preventing worst-case scenarios, but they are also preparing in case they do happen, including with “day after” scenario planning that would allow them to quickly secure or restore customer access, the sources said.
But even small outages can have a big impact, and given that banks are increasingly reliant on systems with the same points of failure as we all are, that can cause problems.
We can no longer assume that a vulnerability is relatively safe simply because exploitation appears too difficult
Shane Fry, chief technology officer at RunSafe Security
During the Iberian power outage in 2025, which was caused by a chain of technical failures in the electricity grid that caused the system to stop functioning for 10 hours, electrical power, telecommunications and internet services rapidly collapsed. Mobile networks stopped functioning generally within 20 minutes of the blackout as backup battery supplies quickly became exhausted. This meant shops, banks, and public services all shut down. ATM’s in the UK aren’t fitted with any extra backup power supply, so with no warning, consumer access to cash would be limited to what they have at home. In the Iberian case, most stores closed due to the wider effects of a lack of power (lights, tills, doors not working), and the smaller stores which were still willing and able to process cash payments could mostly only cope with those being made in round values, as they had access to insufficient change.
There can also be a difference in how individual banks can be affected. Alan Woodward, professor of computer science at the University of Surrey, points out that Revolut was badly hit by the recent Google outage, while HSBC and Lloyds avoided similar problems, in part because their core banking systems still rely on decades-old mainframe computers. In that instance, “old-fashioned technology survived, and the new stuff didn’t,” he says.
“We need to remember we are using old technology that is highly likely to be the cause of many new problems, especially when AI can vulnerability scan and locate much quicker than humans,” says Jake Moore, global adviser at cybersecurity company ESET.
However, what we are currently experiencing is certainly not a one-off. Moore warns that “we should expect to see this a lot in the future”, in large part because vast swathes of the web are reliant on a complex interconnected web of different services, some of which are updated more often than others, and all of which rely on thousands, if not more, lines of code – any one of which could have a tiny flaw in it that AI can quickly exploit.
The nightmare scenario is that problems like these – which have come from trying to avoid the bombardment of requests trying to exploit this issue being successful – don’t just remain confined to school booking systems or council websites. Banks, supermarkets, hospitals and transport networks all require interconnected digital systems to work as expected, and anything that affects enough of them simultaneously is bound to cause significant disruption. The latest outages expose just how dependent we are on fragile digital systems.
A race against AI
AI is constantly speeding up and ramping up the challenges. Just months after leading AI firm Anthropic paused the widespread rollout of its Mythos model because of fears that it could be used to find issues and exploit them, the game has completely changed. The issue with PHP was initially discovered in 2024, but nothing was done about it for a number of reasons. For one, it was seen as too difficult, costly and finicky to fix.
But that decision was taken because the same issues that made it tricky to fix also made it tricky for bad guys to exploit. “We won’t pretend otherwise: the delay was a structural failure,” it acknowledged in a statement this week.
“What the AI did was allow researchers to rediscover it, if you like, but also work out how to exploit it,” he says. Today, AI can rifle through any number of potential attempts to hack into systems and keep going until it hits the jackpot.
We want AI to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control
Raghu Nandakumara, VP of industry strategy at Illumio
“We can no longer assume that a vulnerability is relatively safe simply because exploitation appears too difficult,” says Shane Fry, chief technology officer at RunSafe Security. “Organisations need to harden software at runtime so attackers cannot reliably turn memory corruption into control of a system.”
The use of AI is a double-edged sword: as much as it’s being used by the bad guys, it also helped identify the fact that systems could be exploited, and has enabled the rollout of a fix quite so quickly.
“There’s an important paradox here,” says Raghu Nandakumara, vice president of industry strategy at Illumio. “We want AI to move quickly enough to find vulnerabilities humans might miss, while also making sure that increasingly autonomous systems operate within boundaries we understand and control.”
Control was a key part of what made an already troubling issue into a global cybersecurity incident. “AI located [the problem] fast,” says ESET’s Moore – several companies first spotted it in August, and a remedy was quickly arrived at. “But it got out before the patch and that’s worrying.” In part, that’s down to poor coordination: one cybersecurity firm, Chainguard, chose unilaterally to break an embargo on the issue’s announcement, releasing information about what the vulnerability was six hours before they were meant to. This happened because they suspected time wasn’t on their side; they thought the weaknesses were already being exploited.
The PHP Foundation says this decision meant hackers could potentially work backwards from the fix to understand the problem, at a time when most organisations were still waiting to install it. Cloudflare spotted millions of attempts to exploit the problem within the first 24 hours of it being known.
However, Woodward is more sanguine about the risk of a sudden wave of AI-driven security disasters. He points out that vulnerabilities like this have been discovered regularly throughout the history of the internet.
What AI is doing, he says, is “compressing the whole sort of discovery cycle”, allowing both researchers and attackers to work through problems much more quickly than they could previously. And while that means organisations need to respond faster, the basics of securing their systems cannot be ignored. “Good old-fashioned cybersecurity hygiene and systems operations management. They still matter,” he says.
Back to the Future
We’re not at the point of civilisational collapse of the type you see in Hollywood movies like Leave the World Behind, which sees a mysterious cyber attack plunge the United States into chaos. But every outage highlights how reliant we are on a handful of services and providers, and when they stop working, we stop being able to withdraw money, pay for groceries or access essential public services.
Outages are starting to happen more often, and the threat of hybrid attacks from hostile foreign states is rising all the time. This is why the government is issuing preparedness advice to households to keep emergency supplies that can last a few days.
These include non-perishable food and bottled water (a minimum of 2.5-3 litres of drinking water per person per day) and grab bags for situations where you are advised to leave your home (evacuate) for safety reasons. This is why the LINK ATM scheme – which manages cash points across the UK – put in their written evidence to government in April that retail trade bodies should be encouraged to have contingencies in place, which could include backup power generators for larger stores, solar-powered calculators and sufficient coin and small notes if we needed to quickly revert to non-digital payments. As part of their preparedness planning, the Netherlands recommends that each household should hold €70 for each adult and €30 for each child. In the UK, £50 per adult and £25 per child.
AI isn’t about to bring down the entire internet. Showing the ability to solve extraordinarily complicated mathematical problems, as the latest AI systems from leading labs can, doesn’t automatically mean they can break into a bank. But the increasing prowess AI shows in identifying and exploiting previously overlooked security weaknesses should be a wake-up call for us all.
And as this week’s PHP incident shows, even when a fix exists, getting it installed everywhere is another matter entirely.
Support truly
independent journalism
At The Independent, our mission is to deliver unbiased, fact-based
journalism. Journalism that’s free from political allegiances and
the influences of shareholders and commercial interests.
But we need your help. Your support enables us to uncover crucial
stories that would otherwise have gone untold, hold power to
account, and amplify voices often unheard.
Whether $5 or $50, every contribution counts. It fuels our
reporting, invests in investigations, and maintains our
independence.
Support The Independent today and join us in our mission for truth
and transparency.
