What we know about server outage as 75% of interest risks going dark today
The internet is bracing for a potential mass outage, with EU cybersecurity officials warning organizations that a mass of websites could be taken offline. It comes as developers of the PHP programming language reminded us that October 21 will see the rollout of patches for two critical vulnerabilities.
As PHP is used on swathes of the internet, there's rife speculation that any sites running the software could be exposing themselves to serious cybersecurity threats if they don't go offline. It's estimated that PHP powers more than 75% of all websites on the internet, meaning a server outage could impact millions of sites across major platforms and social media.
What does the October 21 PHP patch mean?
Mark Zuckerberg originally built Facebook entirely on PHP, and while Meta created its own high-performance programming language that was derived from PHP (called Hack) and an engine called HHVM, it's said that its infrastructure is still rooted in PHP.
Advert
Others like Tumblr and Flickr are known for using PHP, and despite largely being a communication tool, Slack's backend infrastructure is primarily built on PHP.
According to Reuters, a patch for both vulnerabilities is scheduled for 1400 GMT/0900 EST/0700 PDT, and in the run-up, Dane Knecht, the chief technology officer of Web and cloud security firm Cloudflare, said attacks were already increasing. It comes as Cloudflare updates its firewall rules as a 'stopgap measure'.
UNILADTech spoke to David Erichsen, Founder at Hoopless. With over a decade of experience building web apps and production systems, Erichsen is a full-stack engineer who leads Hoopless' technical architecture from custom LLM pipelines to the AI infrastructure that keeps them running at scale.
When asked about the severity of the outage, Erichsen reminded us that PHP is fixing two critical flaws that are rated 9.2 out of 10. Researchers say that while these flaws let attackers run their own code on a web server, PHP hasn't published any technical details yet.
Erichsen explained: “If the flaws work against standard setups, this could be one of the most significant web security events in years, because PHP sits underneath WordPress and most of the CMS world.
“We just don't know yet how far-reaching the vulnerability will be across all of the variety of setups."
In terms of what sites will be impacted, anything built on PHP could be in trouble. As this is the majority of hosting environments, Erichsen pointed to WordPress, Drupal, and Joomla sites, as well as WooCommerce and Magento stores, Laravel apps, and hosting control panels like cPanel and Plesk.
Are there wider security risks?
Those most at risk include sites on outdated PHP, with Erichsen adding: “The highest-risk sites are those on outdated PHP. Only PHP 8.2 through 8.5 will get the fix, and anything older is end-of-life with no patch.
“Security firm Mallory counted roughly 884,000 internet-facing servers reporting PHP 8.1 or older and on shared hosting one server can carry hundreds of small business sites."
There are potential wider security risks because hackers who can run code on a server can effectively take it over. Customer data could be stolen, card skimmers might be placed on checkout pages, and malware could be injected into sites. If all that wasn't enough, Erichsen suggests hidden backdoors might be introduced that survive after the patch.
The most dangerous window will be just after release, where Erichsen mentions attackers can compare new and old code to figure out what's been fixed.
When a critical PHP flaw went public in 2024, attempts soared within the first 24 hours. In an era when AI has come so far, Erichsen thinks this could be accelerated further.
Well-maintained sites on supported PHP versions will be patched within a couple of minutes, but older sites are a much bigger challenge, where they could be taken offline or stay dark for weeks.
For now, website owners are encouraged to check what version of PHP they run, take a fresh backup, and store a copy off the server.
There's one final piece of advice, as Erichsen concluded: "After patching, check for new admin accounts and unfamiliar files. A patch closes the hole but doesn’t remove anything an attacker has already planted."
While we hope your favorite sites won't be going under for weeks, it's interesting to note just how much of the web seemingly relies on such a seemingly small feature.