Governments working to identify exposure after global cyber-security warning

ByHelen Sullivan and Rachel Flynn, BBC News. 22 October 2026, 05: 38 BST.

Key points

• Amazon confirmed on Wednesday that it had identified a "PHP2Shell exploitation attempt" that occurred on 17 October.
• As well as its counterparts in the EU and Australia, earlier pressed those who apply PHP to apply the fixes, the UK's National Cyber Security Centre (NCSC).
• In subsequent attacks on Amazon that occurred on 21 October, "the actual payloads and choices in anonymisation infrastructure varied, suggesting these were multiple actors, " Moses remarked.
• The websites for a number of BBC programmes including Doctor Who and The Traitors are at present inaccessible.
• According to The US National Security Agency, the vulnerabilities identified "often provide a direct path to the server's file system or database".

After critical cyber-security flaws were identified in the PHP programming language that underpins a significant number of the world's websites, the UK administration states it is working to identify any potential exposure in its online services.

Governments and some of the world's biggest firms, including Amazon, are rushing to protect systems that apply PHP before hackers can exploit the flaws.

After which governments pressed anyone who uses PHP to address them, the flaws were first discovered by AI.

Amazon was targeted in multiple attempts. It it remarked occurred before an embargo on the warning was lifted. It continued that it was unclear how actors knew concerning the vulnerabilities.

For context, a UK administration spokesperson called on "all organisations, private and public, large and small" to follow guidance to protect their systems.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated, " the NCSC remarked in an official note., external.

PHP powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind plenty of websites like blogs.

When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web.

In the attack, an anonymous internet address attempted to target weaknesses in one of Amazon's decoy or "honeypot" systems, the company's security chief CJ Moses remarked.

For context, the employ of an anonymous IP address suggests that the activity was conducted by a "threat actor", he stated.

While the PHP Foundation intended to release its discovery afterwards this month along with a complete fix for the challenge, usually referred to by software developers as a "patch", details of the flaw were leaked on social media on Tuesday.

For context, the attacks occurred after the leak, but before the embargo was lifted on the PHP warning.

For context, the employ of AI means that "more actors can act within hours or even minutes once technical details of a vulnerability are disclosed", Moses went on.

As "what used to take months, to expose a vulnerability, is now taking days", the PHP incident has "demonstrated how quickly AI is changing our cybersecurity landscape", Australian Council on AI Strategy CEO Anna-Maria Arabia informed the BBC.

She cautioned that threats would only become more commonplace as AI technology rapidly improves. It is "not going backwards, in other words", she remarked. The PHP flaws went undetected for at least a decade.

Though the BBC is unable to independently verify that figure, cyber-security firm Wiz has estimated that "roughly 70%" of the internet is affected.

For context, the websites for a number of BBC programmes including Doctor Who and The Traitors are at present inaccessible.

They have not confirmed a link to PHP – BBC News has approached them for comment.

In practice, the Office for Budget Responsibility (OBR) remarked it had followed guidance to take its website offline, "in view of the critical security issues affecting PHP".

Edinburgh and Oxford council websites additionally went offline on Wednesday, but are now accessible.

What is PHP and why did it spark a global cyber security scramble?

Notably, the Dutch cybersecurity agency went offline as a precaution, and Finland's administration shut down its public web services. Wikipedia additionally took down parts of its website.

This was in line with advice issued by governments, including the US, to take websites down if the flaws could not immediately be fixed.

It could allow attackers to "steal sensitive data, disrupt services, or move deeper into a network. These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration, " the NSA remarked in a afterwards update.

OpenAI called the discovery, "one of the most impactful security issues in recent memory". Websites taken down worldwide as critical cyber-security update issued.

Obtain our flagship newsletter with all the headlines you need to start the day. Sign up here.

In short, governments working to identify exposure after global cyber is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.