Stories

Wed, 21 Oct 2026

Wed, 21 Oct 2026 Websites taken down worldwide as critical cyber-security update issued

The vulnerabilities with PHP, a programming language widely used across the internet, have been described as the most significant ever found by AI.
Global cyber-security agencies have issued warnings that two critical vulnerabilities in PHP programming language could allow hackers to access sensitive data and take down websites. Multiple organizations, including the Finnish government, Edinburgh council, and BBC, have taken their sites offline as a precautionary measure until a fix is available. The flaws were discovered by AI-powered tools developed by cyber-security firm Wiz, who described them as "the most severe vulnerabilities ever discovered". The PHP Foundation had planned to release a patch for the issue later this month, but was forced to rush out an announcement after details of the flaw leaked on social media. It is estimated that up to 70% of websites use PHP, including popular platforms such as WordPress and Joomla. Cyber-security experts warn that hackers will likely target these vulnerabilities, which could allow them to install malware and gain access to sensitive data. The European Union's Computer Emergency Response Team (CERT-EU) has given the vulnerabilities a high-risk score, indicating the potential for unauthenticated remote code execution. The UK's National Cyber Security Centre (NCSC) and other agencies have urged organizations to take immediate action to address the issue. Organizations that use PHP are advised to apply the latest patches as soon as possible, while those unable to do so should consider taking their systems offline until a fix is available.