Attackers probed a critical PHP flaw four days before defenders were warned

A four-day head start

According to Ars Technica, attackers were probing the flaw before defenders were told it existed, a gap of four days that gave them time to look for vulnerable servers. The outlet described the bug as an "epic" PHP vulnerability.

Why it spread so widely

PHP is a long-standing language used to build and run websites, and plenty of that code sits on shared hosting and older servers where updates arrive slowly. When a flaw appears in such a common building block, the same weakness can turn up on many unrelated sites at once.

What happened next

Many websites were taken offline on Thursday as organisations rushed to install fixes, so the disruption reached ordinary visitors rather than only security teams. The practical lesson for anyone running a site is unchanged: a patch only protects you once it is actually installed.