What is PHP and why did it spark a global cyber-security scramble?

ByLiv McMahon, Technology reporter and Osmond Chia, Business reporter. 22 October 2026, 04: 48 BST.

Key points

• AI could additionally produce such attacks easier and faster, Paul Spain, chief executive of Gorilla Cyber Security, informed the BBC.
• The UK's National Cyber Security Centre offered similar advice and informed organisations to check for "backdoors installed by an attacker".
• Japanese Prime Minister Sanae Takaichi pressed residents to check if their publicly available websites ran on PHP.
• Sites and pages have been taken offline by the Finnish administration, Edinburgh council and the BBC, with the Netherlands' cyber-security agency additionally pulling its website.
• "These risks are serious enough to require immediate patching across United States Government departments and agencies, " the agency remarked.

For more than a decade, serious flaws had gone undetected in the technology underpinning much of the internet.

It took AI to bring them to light and caused a global cyber-security alert.

Notably, the vulnerabilities lie within a programming language called PHP. It has been applied internationally since the 2000s to build websites.

Governments and cyber-security agencies worldwide are scrambling to contain the fallout of the discovery on Wednesday, and have pressed website operators to install a new emergency fix or consider taking their platforms offline.

Cyber-security firm Wiz – one of the firms whose researchers uncovered the vulnerabilities – described the flaws as the "most severe" ever detected by AI.

OpenAI, whose technology was applied to find the flaws, called the discovery "one of the most impactful security issues in recent memory". Cyber-security matter hitting sites worldwide prompts 'millions' of hacking attempts.

Most individuals may not have heard of PHP, but they probably interact with it daily.

It stands for PHP: Hypertext Preprocessor, an open-source, back-end programming language which runs on a web server.

Developed in the early 1990s to support serve dynamic web pages and applications, PHP still powers lots of platforms today, including Wikipedia, online shops and WordPress – the system behind numerous websites.

When you visit a site, PHP is the code which collects data and effectively turns it into a page you can read.

It has additionally been employed to write a number of tools for building or speeding up the creation of web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.

According to cyber-security firm Wiz. It supported uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.

It is maintained by a non-profit called the PHP Foundation, external, composed of individuals and firms which depend on the language and aim to ensure its "long-term prosperity". What is the vulnerability?

For context, a group of cyber-security researchers and organisations disclosed two vulnerabilities within PHP this week. It they cautioned could have the potential to upend sites throughout the internet.

Cyber firms Wiz and Calif remarked the flaws – coined "php2shell" – were inherent in the language itself, with versions of PHP issued over the last decade affected.

Ryan Austin, a Calif researcher who supported uncover the security matters, informed the BBC it was "the most serious vulnerability I've ever found".

Wiz wrote in a blog post, external regarding its findings that, under the right conditions, hackers could exploit the php2shell problem to take control of affected web servers and steal sensitive data – saying everything built on PHP was left exposed.

AI could additionally produce such attacks easier and faster, Paul Spain, chief executive of Gorilla Cyber Security, informed the BBC. He estimated the flaw could affect "millions and millions" of websites.

Jill Slay, a cyber-security researcher at the University of Adelaide, remarked it would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites. What websites have been affected?

In practice, the alert has disrupted services globally, from gaming platforms to administration portals and online forums.

That includes Wikimedia – the organisation behind the online encyclopaedia Wikipedia – which took down a number of its systems as a precautionary measure.

For context, a number of Scotland's public organisations, including councils and health boards, have additionally taken their websites offline.

Some experts warn the vulnerability could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk.

More attempts to exploit these flaws are probable in the coming weeks since the technical details are now being produced public, cyber-security researcher Salil Kanhere from UNSW Sydney noted. What happened after the flaws were exposed?

Notably, the PHP Foundation rolled out patches on Wednesday to fix the vulnerabilities that had been lurking in their software for years.

"All PHP users are strongly encouraged to update immediately, " the firm stated.

Authorities and security organisations worldwide have echoed those warnings to website operators to secure their platforms.

For context, the US National Security Agency informed all organisations that apply PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database.

For context, the UK's National Cyber Security Centre offered similar advice and informed organisations to check for "backdoors installed by an attacker".

Its counterparts in the EU, Singapore and Australia have additionally issued similar alerts.

"We have an urgent request for everyone to take action tonight, " Takaichi wrote on X.

"If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk, " she remarked. Tech firms have additionally sought to rapidly secure their systems.

E-commerce giant Amazon remarked it was targeted in multiple attempts days before the public disclosure of the PHP problem, but its websites were operating as normal.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, additionally stated it had seen "thousands" of attempts to exploit the PHP vulnerabilities throughout its network in the 10 hours before it was publicly unveiled.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now, " he wrote on X, external. How was AI involved?

Researchers at Calif and Wiz who located the vulnerabilities applied advanced AI tools which can analyse code and find flaws much faster than humans or older systems.

In short, what is PHP and why did it spark a global cyber is the central thread here, and readers can expect follow-up reporting as the picture becomes clearer.