Microsoft’s chief executive Satya Nadella told a conference he had not seen anything like the PHP emergency “in a long, long time”, and added: “it was a long day and a long night, I know, for all the IT and security folks.”
He was right about the long night. What is becoming clear a few days later is that a meaningful part of it was spent reacting to information that was not true.
What the week was actually like
“It’s been relentless,” said Adam Mudd, a UK-based system administrator, who told the BBC’s Joe Tidy he had never received so many messages from worried website owners.
“The biggest challenge has been juggling clients who want their sites taken offline as a precaution, while trying to coordinate updates and fixes across countless different setups,” he said. “Sometimes it takes me longer to take a website down than to fix the PHP problem.”
He was working early and finishing at 22:30 BST.
In Mauritius, IT administrator Loganaden Velvindron hit a harder version of the same problem. “Many versions of php running are completely end-of-life, so we are having to rebuilding web apps and change code in some cases,” he said. Where there is no newer package to install, patching becomes a rewrite — and he had no warning to prepare for one.
Jon Jones, technical director at a digital advertising company, described the strange energy of it. “Seeing the warning drop was definitely eye-opening and a new experience we’ve not dealt with before,” he said. “But, in a way, it was exciting feeling like a bit of a Hollywood action scene.” When the patch landed at 15:00 BST on Wednesday, “the race was on” — though he noted the thing every administrator knows: “there’s always a chance than an update can cause other issues.”
The intelligence that was wrong
The reason the race felt so urgent was a widely circulated claim that criminals already had working attacks. Security researchers are now saying that claim was largely noise.
“We were flooded with rubbish intel about hackers being out there actively with working Proof of Concept (PoC) methods,” said UK cyber expert Daniel Card, who had been going flat out since the rumours started circulating on Tuesday. “This isn’t the first time we’ve had a situation like this but it feels like it’s been on another dimension.”
He is clear that the vulnerabilities themselves deserved to be taken seriously. His frustration is with the reporting around them.
Government agencies issued alerts — including, remarkably, the Prime Minister of Japan. And at least one major cyber-security company published a warning that attackers had a working proof of concept, then had to retract it.
The number that did not materialise
Cloudflare and AWS both reported millions of hacking attempts per hour. That figure travelled a long way, and it is worth separating from the one that matters.
An attempt is a request arriving at a server. A breach is an attacker getting in. As things stand there is no evidence of large-scale data breaches or cyber-attacks arising from these flaws.
Attackers have been seen using AI to try to build working attack methods. None of them appears to be working at scale yet — which is a statement about this week, not about next month.
The warning about warnings
AI found these flaws, hidden from human researchers for decades. Everyone quoted above expects that to keep happening. Which makes the way alerts are written a live problem rather than a debating point.
Mark Maunder, founder of the WordPress security tool Wordfence, put it directly: “We’re going to find scary vulnerabilities with the amazing capabilities that OpenAI and Anthropic are bringing online, but we need to calibrate the messaging.”
His worry is alert fatigue. If every discovery arrives at maximum volume, the response to the one that is genuinely being exploited will be slower, not faster, because the people who have to act will have learned to discount the siren.
How to read the next one
For anyone running a site in Bangladesh, the practical lesson is about sequencing. Patch on the advisory from the maintainers, which is a verifiable technical document. Do not patch on a screenshot, a forwarded voice note or a vendor blog claiming active exploitation, and do not take a working site offline on the strength of one.
And separate the two questions that got merged all week: is my software affected, which the version numbers answer, and is anyone attacking me, which your logs answer. The first demands action. The second demands evidence.
Related: what cPanel site owners here must do.
