What is PHP and why did it spark a global cyber-security scramble?

Updated 23 October 2026

It took AI to bring them to light and caused a global cyber-security alert.

Researchers who helped surface the vulnerabilities in PHP - a popular server-side programming language used in web development for decades - warned platforms which use it could be exposed to potential hacks.

Governments and cyber-security agencies rushed to contain the fallout, urging website owners to check if their sites were affected and, if so, install updates to patch the issue or consider going offline.

But in the days since the issues came to light, disruption to sites and services has continued to ripple around the world.

What is PHP?

It stands for PHP: Hypertext Preprocessor, an open-source, back-end programming language which runs on a web server.

Developed in the early 1990s to help serve dynamic web pages and applications, PHP still powers lots of platforms today, including Wikipedia, online shops and WordPress – the system behind many websites.

It has also been used to write a number of tools for building or speeding up the creation of web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.

It is maintained by a non-profit called the PHP Foundation, external, composed of individuals and companies which depend on the language and aim to ensure its "long-term prosperity".

What is the vulnerability?

A group of cyber-security researchers and organisations disclosed two vulnerabilities within PHP this week, which they warned could have the potential to upend sites across the internet.

The technical bugs, given the technical IDs CVE-2026-109618 and CVE-2026-109619, were ranked a 9.2 out of 10 in severity by researchers.

Wiz wrote in a blog post, external about its findings that, under the right conditions, hackers could exploit the bugs to take control of affected web servers and steal sensitive data - saying everything built on PHP was left exposed.

He estimated the flaw could affect "millions and millions" of websites.

Jill Slay, a cyber-security researcher at the University of Adelaide, said it would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites.

What websites have been affected?

It included Wikimedia - the organisation behind the online encyclopaedia Wikipedia - which took down a number of its systems as a precautionary measure.

Sites and pages were also taken offline by the Finnish government, Edinburgh council and some BBC pages, with the Netherlands' cyber-security agency also pulling its website on Wednesday.

But while many sites were back up by Thursday, others were still being taken down temporarily elsewhere as people and businesses check for potential exposure.

The UK Government revealed on Thursday some "limited" services may be offline temporarily.

In France, telecommunications company Orange also said it had suspended access to certain services globally while it deployed security fixes.

According to the Mainichi newspaper, external, SoftBank customers have been urged to make sure they have other ways to get alerts about natural disasters - with its mobile phone alerts not set to sound even in the event of a strong earthquake.

Some experts warn the issue could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk.

More attempts to exploit these flaws are likely in the coming weeks since the technical details are now being made public, said cyber-security researcher Salil Kanhere of UNSW Sydney.

What happened after the flaws were exposed?

"All PHP users are strongly encouraged to update immediately," the company said.

The US National Security Agency told all organisations, external that use PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database.

Its counterparts in the EU, Singapore and Australia have also issued similar alerts.

Image source, Bloomberg via Getty Images

Tech companies also sought to quickly secure their systems.

E-commerce giant Amazon said it was targeted in multiple attempts days before the public disclosure of the PHP issue, but its websites were operating as normal.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, also said it had seen "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he wrote on X, external.

And operators of a number of services where PHP may have been used - not just in web development - are still being urged to check their systems and implement updates, where necessary.

"It is important to remember that PHP is not limited to web applications," said Daniel Stewart, head of threat intelligence at global risk manager LRQA.

According to some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches has climbed - but not as quickly as might be hoped globally.

How was AI involved?

Researchers at Calif and Wiz who located the vulnerabilities used advanced AI tools, developed by ChatGPT-developer OpenAI, which can analyse code and find flaws much faster than humans or older systems.

"The underlying bugs weren't new; what changed was our ability to find them," Kanhere said.

Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale.

The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post.

"Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security in mind," said Ryan Ko, at the University of Queensland's Cyber Research Centre.

What does it mean for you?

The issue affects back-end website and web development processes that will be invisible to many users - meaning most people won't need to take any action.

Those who own websites or manage infrastructure running PHP have been urged to secure their websites by updating to the latest version.

Ethical hacker Ken Munro, who has spent years finding security flaws in computer systems, says installing the fixes - known as patching - is "a bit like running a Windows update".

If a hosting company or web developer manages your website, contact them and ask whether the PHP security fixes have been applied - something that must be applied to PHP itself and cannot be resolved by updating WordPress or its plugins.

The UK's National Cyber Security Centre recommends, external considering temporarily taking sites offline if updates or temporary protections cannot be applied quickly enough.

"Vigilance in applying patches related to those systems is paramount," it said.

He warned people to be alert to any phishing messages exploiting the publicity around the incident too.