The alarming reality of the worldwide website emergency: As a PHP weakness sparks a global cybersecurity alert, experts warn 'this is going to happen again'

A decades–old piece of software has sparked one of the biggest cybersecurity alerts in recent memory after a hidden security flaw suddenly came to light.

Websites around the world have gone dark as hackers launched millions of attempts to exploit a vulnerability in the PHP programming language.

This is a critical open–source system that is built into 70 per cent of all websites on the internet, from Wikipedia to government agencies.

While these critical weaknesses have been found and patched, cybersecurity experts now warn that overreliance on ageing software means future crises are inevitable.

However, PHP is only part of the problem, with the entire internet now dependent on a handful of open–source programmes.

Jake Moore, Global Cybersecurity Advisor at ESET, told the Daily Mail: 'Much of the internet relies on shared software that most people have never heard of, and it often creates a bottleneck for security issues.

'When there is a problem with specific technology, it can be catastrophic.

'I am confident this is going to happen again. But the concern isn't just discovering these flaws; it's all about how quickly we can patch them before criminals exploit them.'

The internet as we know it is only possible due to a bewildering mix of software and programming languages.

Like PHP, many of these are open–source projects that are created and maintained for free for anyone to use, often by volunteers working in their spare time.

Professor Raj Rajarajan, Director of the Institute for Cyber Security at City University of London, told the Daily Mail: 'The web was built on open–source software.

'When startups build new products, they all look for open source software to minimise cost. In addition, they also like the free support you get to develop new products from the open source community.'

PHP, also known as Hypertext Preprocessor, is one of the oldest and most fundamental pieces of open–source software keeping the web together.

It was one of the very first pieces of 'server–side' web code, which allows websites to 'talk' with databases held on servers.

Whenever you visit a website, PHP is the piece of software that gathers the information you need and presents it in a way you can actually read online.

'It was an early part of web development in the late 90s,' says Professor Rajarajan.

'It was easy to adopt, low cost to maintain and mainly was useful to build dynamic webpages. Since then, due to its ease of use and availability in many legacy systems, we carried on using it.'

Over time, as more websites started to be built around the PHP programming language, it became so deeply embedded in web infrastructure that it was almost impossible to remove.

Today, PHP isn't just in individual websites; it has been built into medical patient portals, booking systems, online shopping forms, alongside countless other plugins and third–party systems.

Julie Nicholson, Director of Cyber Resilience at Advania UK, told the Daily Mail: 'Over time it became embedded across a significant part of the web, so you're dealing with decades of investment and dependency. Replacing something at that scale simply isn't straightforward.'

Since PHP still works and replacing it would be enormously expensive, companies are more than happy to keep on using it.

This is why so much of the modern internet is still cripplingly dependent on a single piece of 20–year–old software.

However, PHP is not the only piece of software that the internet relies on, and studies estimate that 95 per cent of all software today contains some open–source components.

Open–source software isn't necessarily a bad thing, but the problem arises when a massive number of companies are using software they don't fully understand or have control over.

'I think there is a concentration risk,' says Ms Nicholson.

'We've built so much of the internet around a relatively small number of very successful technologies, and that creates a dependency.

'When something widely used has a serious vulnerability, the potential impact is much greater because so many organisations can be affected at the same time.'

Additionally, the very nature of open–source projects means that they might be more vulnerable to attack than software made by bigger private organisations.

Dr Johan Linåker, of Lund University, told the Daily Mail that developers have become 'overly confident' in open–source software.

He says: 'Each open source building block is its own project with its own community of people, hobbyists or professionals working on their employers' behalf. 

'Too often, the number of people and time available is far too limited compared to the ideal. 

'If there's no eyes on the code, bugs and vulnerabilities can easily be missed, or neglected.'

In the past, weaknesses in open–source systems like PHP weren't as much of a problem as they are today.

If researchers found a vulnerability or noticed that hackers were exploiting a weakness, developers would quickly make a patch and distribute it to every user.

Since the speed with which hackers could find problems was slower, developers might have weeks to safely find a problem, develop a solution, and make sure all their users updated the software.

In fact, a lot of developers still champion these open–source systems as a really efficient, fair and responsible way of running the web.

Don Smith, Vice President of Threat Intelligence at Sophos Counter Threat Unit, told the Daily Mail: 'It could be argued that this is a significantly better position than the internet being reliant on commercial, closed–source software in the hands of a small number of vendors.'

Likewise, Dr Deepak Padmanabhan, of Queen's University Belfast, told the Daily Mail: 'It may look a bit odd, but in a way, community–built software has been often regarded as hugely successful and remarkably resilient.

'Corporate–managed software is driven by the overarching profiteering impetus of companies, so they would do only what is absolutely needed to ensure that the software is perceived widely as safe enough.

'On the other hand, a bunch of programmers who do it out of their voluntary interests would probably be able to invest more time in quality checks than what is absolutely required to sell the software.'

However, Dr Padmanabhan, like many other experts, also acknowledges that the internet is changing at a disturbing pace.

Today, the growing power of AI models has collapsed the time between spotting a flaw and hackers exploiting it for cyber–crime, and many experts are now uncertain about the future of open–source software.

After it was announced that researchers had found a vulnerability in PHP, it took just days for independent hackers and coders to find their own versions of the exploit using AI.

Dan Lorenc, CEO and co–founder of Chainguard, even posted a full version of the PHP patch on Tuesday, a full day ahead of the embargo.

In a post on LinkedIn, Mr Lorenc explained that the decision was made after his firm was able to 'independently discover the same issue using our harness and a frontier model with a basic prompt of "find bad vulnerabilities in PHP"'.

Likewise, Matthew Prince, CEO of cybersecurity firm Cloudflare, wrote on X: 'In the 10 hours before it was publicly ​announced, across the network we saw ‌thousands of attempts to exploit it.

'That jumped to tens of ​thousands in the 45 minutes post–announcement, hundreds of thousands within two hours, and millions ​now.'

Amazon even reported that one of its 'honeypot servers' – fake servers used to trick hackers – had been hit with an attack using the PHP vulnerability on November 17, four days before the public reveal.

With AI accelerating the way hackers can target flaws in public software, some experts are now worried that an overreliance on a few open–source technologies could lead to disaster.

Dr Daniel Gardham, cybersecurity expert from the University of Surrey, told the Daily Mail: 'AI makes it easier to discover vulnerabilities in complex software. Techniques that once required a team of highly specialised researchers may become accessible to a much wider range of people. 

'Of course that works both ways, security researchers can find and fix flaws more quickly, but attackers can use similar capabilities to identify weaknesses and develop exploits.'

Professor Rajarajan adds: 'Big security companies are developing multi–agent systems for cyber security.

'These AI agents have to work at a pace we haven't experienced in the past to make sure the internet is safe in real time, not just discovering threats but also mitigating or defending in real time in the current geopolitical environment. A bit like a real battlefield!'

The future might involve companies using AI tools of their own to build a more decentralised version of the web, something experts call Web 4.0.

However, for the time being, the reality is that open–source systems like PHP are a fundamental part of the internet that aren't going away in a hurry.

And as long as the world relies on a handful of key programmes, these will always be tempting targets for hackers looking to cause chaos.