The UK government is assessing its exposure after critical flaws were found in PHP, a programming language that powers a vast share of the world's websites. Governments and major companies are rushing to apply fixes before hackers can exploit the vulnerabilities, which were discovered by AI and then leaked online.
Simple details
- PHP is code that helps websites show you information on your screen.
- AI found the bugs, but details leaked before the official fix was ready.
- Amazon said hackers tried to attack its systems before the warning became public.
- The UK's cyber agency advised taking websites offline if they can't be fixed fast.
- Some BBC programme sites and government websites were temporarily inaccessible.
What happened with the PHP flaws
Critical security flaws were identified in PHP, the programming language behind many websites including Wikipedia and WordPress.
The UK government says it is working to identify any potential exposure in its online services after the global warning.
Amazon reported multiple attack attempts on its systems, including a "PHP2Shell exploitation attempt" on 17 October targeting a decoy system.
Further attacks occurred on 21 October after details of the flaw were leaked on social media before the embargo lifted.
Why it matters for websites and users
The vulnerabilities could allow attackers to steal sensitive data, disrupt services, or move deeper into networks, according to the US National Security Agency.
OpenAI described the discovery as one of the most impactful security issues in recent memory.
The incident shows how AI is accelerating the cyber threat landscape, with vulnerabilities now being exploited in hours rather than months.
Australian Council on AI Strategy CEO Anna-Maria Arabia warned that threats will become more commonplace as AI technology rapidly improves.
- Government websites in the UK, Netherlands, and Finland
- Public sector bodies such as the UK Office for Budget Responsibility
- Local council websites in Edinburgh and Oxford
- Major platforms including Wikipedia and BBC programme sites
- Companies worldwide using PHP for online services
How we got here from AI discovery to leak
The flaws were first discovered by AI researchers, and the PHP Foundation planned to release a complete fix later this month under an embargo.
However, details were leaked on social media on Tuesday before the official release, triggering immediate exploitation attempts.
Once technical details became public, multiple threat actors began attempting exploitation within hours using varied anonymisation infrastructure.
Amazon's security chief CJ Moses said the use of AI means more actors can act quickly once vulnerability details are disclosed.
Reality check
The estimate that 70% of the internet is affected comes from Wiz, but the BBC could not independently verify that figure.
Taking websites offline is a precaution, not a guarantee of safety, and it disrupts access to essential services for users.
The leak meant that the standard security process of coordinated disclosure was bypassed, leaving defenders with less time to prepare.
Not all affected sites have confirmed a link to PHP, so some outages may have unrelated causes.
Who should buy and who should skip
- Organisations running websites built on PHP
- IT managers responsible for server security
- Businesses relying on WordPress or similar platforms
- Government agencies with public-facing digital services
- Individuals who only browse websites and do not manage servers
- Users of platforms that have already applied the patch
- People who do not host their own web services
- Those relying on fully managed cloud services that handle updates automatically
What happens next for organisations
The UK's National Cyber Security Centre has urged all organisations using PHP to apply the available fixes immediately.
Where immediate remediation is not feasible, the NCSC recommends taking systems offline until fully mitigated.
Governments in the US, EU, and Australia have issued similar guidance advising organisations to prioritise patching or temporary shutdowns.
The Dutch cybersecurity agency and Finland's government have already taken services offline as a precaution.
- Whether organisations apply patches before further exploitation occurs
- If more websites go offline as a precautionary measure
- How quickly AI-driven exploitation techniques evolve
- Whether the PHP Foundation releases its complete fix as planned
- If additional vulnerabilities are discovered in related systems
Verdict
This is a critical security event that requires immediate action from anyone managing web infrastructure. If you run a website using PHP, you must check for updates and apply fixes now. If you are just a user, expect temporary disruptions as sites go offline for safety.
Key facts at a glance
PHP powers a vast number of platforms including online shops, Wikipedia, and WordPress.
Wiz estimated roughly 70% of the internet is affected, though BBC could not independently verify that figure.
- The flaws were discovered by AI and leaked before the official embargo lifted
- Amazon detected exploitation attempts on 17 and 21 October
- NCSC advised taking systems offline if immediate fixes are not possible
- Multiple governments urged organisations to follow security guidance
Read the news report this explainer is based on: UK working to identify exposure after global cyber-security warning.
Source: Ebenezer News Explainer Desk · Ebenezer News Explainer Desk. Published 22 Oct 2026, 06:36 am.
