UK working to identify exposure after global cyber-security warning

Britain says it is working to determine whether any of its online services are exposed after a global alert over serious security flaws in PHP, the programming language behind a huge share of the world's websites.

Governments and major companies are scrambling to protect systems that rely on PHP after the vulnerabilities surfaced. Cyber agencies in the UK, the EU and Australia have urged anyone using the language to apply fixes, and where immediate fixes are not possible, they advise taking affected systems offline as a precaution.

The flaws, first discovered by AI, had gone undetected for at least a decade and are striking in scale. Cyber-security firm Wiz estimates roughly 70 percent of the internet could be affected, though the BBC could not independently verify that figure. Alan Woodward of the Surrey Centre for Cyber Security put the exposure at around 30 million websites, warning attackers could steal data or move deeper into networks. Researcher Ryan Austin, who has studied PHP security for 20 years, called it the most serious vulnerability he has ever found.

Amazon said its threat-intelligence system spotted an attempted exploit on Saturday -- a "PHP2Shell" attack on one of its decoy systems from an anonymous internet address -- which it automatically detected and restricted. The attacks came after details leaked but before the PHP Foundation's planned disclosure with a complete fix, which had been due later this month. OpenAI called the discovery "one of the most impactful security issues in recent memory."