Key Points
- Websites operated by government bodies, public services and other organisations were taken offline as a precaution following the discovery of two critical vulnerabilities in PHP, a programming language widely used to power websites.
- The BBC reported on 21 October 2026 that affected or potentially affected services included Finnish government websites, Edinburgh City Council’s website and online pages associated with BBC programmes, including Doctor Who and The Traitors.
- The vulnerabilities were identified by researchers at Calif and Wiz using advanced artificial intelligence tools, highlighting AI’s growing role in discovering serious software security weaknesses.
- Wiz described the vulnerabilities as among the most severe ever discovered using AI, while the reported estimate that approximately 70% of the internet could be affected has not been independently verified by the BBC.
- PHP developers released security updates addressing the vulnerabilities, prompting urgent calls for organisations to patch vulnerable systems or temporarily take affected services offline.
- The UK’s National Cyber Security Centre (NCSC), European cyber-security authorities, Australian agencies and Japan’s national cyber-security office issued warnings or guidance urging organisations to act.
- Cloudflare reported observing early attacks associated with the security issue, underlining the importance of rapid remediation.
- The incident demonstrates the importance of IT and Computer Science, Artificial Intelligence (AI) and Safety and Security expertise in managing software vulnerabilities, protecting digital infrastructure and maintaining the reliability of online services.
Why Were Websites Taken Offline Around the World?
Government bodies, public-service providers and other website operators took precautionary action on Wednesday, 21 October 2026, after two critical vulnerabilities in PHP prompted an international cyber-security response. The PHP development team released security updates, while authorities urged organisations to patch their systems immediately or temporarily disconnect vulnerable services where the risks could not be addressed in time.
As reported by Tom Gerken of BBC News in “Websites taken down worldwide as critical cyber-security update issued”, the disruption affected websites and online services in several countries, with Finland’s government web services, Edinburgh City Council’s website and pages associated with BBC programmes among those reported to have gone offline.
The response was precautionary in many cases. A website becoming inaccessible did not, by itself, establish that it had been hacked or that information had been stolen. Reuters reported that several authorities had not identified evidence of a breach when they disabled services, while security providers warned that the vulnerabilities could create opportunities for attackers.
The vulnerabilities were particularly concerning because PHP operates behind the scenes on a substantial portion of the internet. It helps websites generate pages, process requests and interact with databases. A flaw in this shared software can therefore affect many otherwise unrelated organisations at the same time.
The incident also highlighted a significant development in cyber-security: researchers used advanced artificial intelligence tools to identify weaknesses that had remained hidden in software for years. AI helped researchers uncover the problems, but it also raised concerns that attackers could use similar capabilities to develop exploits more quickly once technical details became public.
Which Websites and Organisations Were Affected?
The international response included government services, public-sector websites, educational and healthcare platforms, and other internet services.
According to BBC News, Finland temporarily shut down public government web services, while the Dutch cyber-security agency also took its website offline. Edinburgh City Council’s website became inaccessible, and online pages for BBC programmes including Doctor Who and The Traitors were reported to have been affected. The BBC said it had approached the relevant organisations for comment about the reported outages and their connection to PHP.
Reuters provided further details about the scale of the precautionary measures. In the Netherlands, affected or suspended services included the Port of Rotterdam, the national government portal Overheid.nl, the Royal Dutch Football Association (KNVB), websites for the country’s five largest political parties and several hospital websites. Dutch organisations acted after their National Cyber Security Centre had taken its own precautionary steps.
In Denmark, municipal IT company Kombit said it had shut down several services, including the national school communication platform. In Germany, a spokesperson for the digital ministry told Reuters that the federal IT service provider ITZBund had taken several websites offline. The spokesperson described the action as preventive and said no security incidents were known to have occurred.
France also temporarily disabled the websites of prefectures, which are local government administrative offices, while awaiting a security fix for the PHP framework they used. Belgium’s foreign ministry said it had taken its websites offline following reports of attacks exploiting the vulnerabilities, although the country’s cyber-security centre said it had not recorded attacks on Belgian websites.
These distinctions are important. Reports of an outage, a precautionary shutdown and a confirmed cyber-attack describe different situations. Organisations may disconnect a website to reduce exposure even when they have no evidence that an intruder has accessed their systems.
The disruption also reached beyond government websites. Other services were reported to be temporarily unavailable or undergoing maintenance, including platforms used for gaming, online content and cloud-based services. However, not every reported outage was independently confirmed to have resulted from the PHP vulnerabilities. The precise cause of each disruption therefore requires separate verification.
What Were the PHP Vulnerabilities and Why Were They Considered Critical?
PHP, short for PHP: Hypertext Preprocessor, is an open-source, server-side programming language used to build and operate websites and web applications. It processes requests on a web server, works with databases and generates the content delivered to a visitor’s browser. It is also incorporated into widely used website platforms and content-management systems, including WordPress, Drupal, Joomla and Magento.
On 21 October, the PHP development team published fixes for two vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. The PHP security team had announced the forthcoming emergency release a day earlier, rating both flaws 9.2 out of 10 under the CVSS 4.0 severity-scoring system.
The UK’s National Cyber Security Centre explained that the vulnerabilities involved memory-handling problems that could, under certain conditions, allow an attacker to execute commands remotely without authentication.
The first vulnerability, CVE-2026-109618, concerns PHP’s handling of an out-of-memory condition. According to the NCSC, this could interrupt processing while internal request data was only partially initialised, allowing subsequent cleanup operations to treat invalid data as valid.
The second vulnerability, CVE-2026-109619, involves internal state associated with a request remaining after the memory backing it has been freed. A later request processed by the same worker could potentially use that stale state before normal initialisation reset it.
The security implications extended beyond a website temporarily displaying an error. If successfully exploited, the weaknesses could allow an unauthenticated attacker to run malicious code on a vulnerable server. Depending on the environment and the attack’s success, this could create a route towards unauthorised access to server files, databases or other connected resources.
Reuters reported that the US National Security Agency warned that vulnerabilities of this kind can provide a direct route to a server’s file system or database. The agency advised organisations that could not update immediately to take affected systems offline until the risk had been mitigated.
The PHP security advisory also identified installations using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among those potentially at risk when serving web requests. The developers identified mod_php as a particularly concerning configuration because a demonstrated exploit could trigger the attack before application code ran.
How Did Artificial Intelligence Help Researchers Discover the Flaws?
The vulnerabilities attracted international attention partly because researchers used advanced AI systems to identify security weaknesses in widely deployed software.
In its 21 October announcement, OpenAI said that Calif had identified a critical PHP flaw using GPT-5.6 Sol as part of its Patch the Planet initiative. Cybersecurity company Wiz independently discovered and reported both vulnerabilities. PHP’s maintainers led the remediation and release process, while researchers and technology providers contributed analysis, testing and preparations for deployment.
Reuters reported that Wiz used its Wiz Atlas autonomous AI vulnerability-research tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol in its research. Wiz said the vulnerabilities had remained hidden in the PHP codebase for more than a decade and that exploiting them would previously have been extraordinarily difficult for human researchers to implement and scale.
The findings illustrate how AI can help security teams analyse complex code, investigate potential failure conditions and develop working demonstrations of vulnerabilities. Such capabilities can accelerate defensive research, particularly in software maintained by teams with limited time and resources.
However, the same capabilities create risks. Once technical details or patches become public, attackers may use AI to understand the weaknesses and develop attacks against systems that have not yet been updated.
OpenAI described the PHP incident as one of the most impactful security issues in recent memory and said the case demonstrated both the potential of AI to uncover vulnerabilities with internet-scale consequences and the possibility that similar capabilities could help attackers develop offensive tools. The company said it believed the vulnerabilities had been found by advanced AI before attackers discovered them, giving maintainers and security providers time to prepare fixes.
How Many Websites Could Be at Risk?
The potential scale of the incident was a central concern for security professionals.
Wiz estimated that approximately 70% of the internet could be affected, according to reporting by the BBC and other outlets. That figure should be treated as an estimate rather than a verified count of vulnerable or compromised websites. The BBC reported that it could not independently verify the figure.
Separately, Reuters cited web technology tracker W3Techs in reporting that PHP runs on roughly 75% of websites whose programming language can be identified. These percentages refer to estimates of PHP’s prevalence, not proof that every website using the language was successfully exploitable or had been attacked.
The widespread use of PHP means that a single vulnerability can have consequences across multiple sectors. Public authorities, online publishers, retailers, healthcare providers, educational institutions and other organisations may rely on PHP directly or through software supplied by another vendor.
Smaller businesses may face additional challenges. Some use shared hosting services where they do not directly control the underlying server or manage PHP installations themselves. As Reuters reported, organisations with limited technical resources could take longer to deploy fixes and might remain exposed after security updates become available.
This makes communication between website owners, hosting providers, software vendors and cyber-security teams particularly important. A business may need to establish which components it uses, whether a supplier has applied the relevant fix and whether any additional action is necessary before its service can safely return online.
What Security Updates Were Released and What Should Organisations Do?
The PHP development team published security releases on 21 October for supported versions 8.5, 8.4, 8.3 and 8.2. The patched versions were PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The updates address both critical vulnerabilities, and the developers urged users to install them immediately.
The team also noted that PHP 8.1 and earlier no longer receive updates directly from the PHP project, although some operating-system distributions and long-term-support vendors may provide backported fixes. Organisations using older installations were advised to consult their vendors or move to supported versions.
The UK’s National Cyber Security Centre published practical guidance for organisations. Its recommendations included identifying all PHP installations across their infrastructure, prioritising internet-facing systems, monitoring for suspicious activity, applying the relevant updates, and checking for security fixes in third-party products that bundle PHP.
The NCSC also advised organisations unable to update promptly to consider temporary mitigations. Where those measures could not be applied quickly enough, it recommended taking systems offline until the vulnerabilities could be fully addressed. Organisations that could not immediately update or disable a system were also advised to assess whether it had already been compromised and seek specialist assistance if necessary.
The NCSC stressed that all organisations using PHP should update to the latest fixed version, rather than limiting checks to installations they already knew to be outdated. This is particularly important where PHP is included within hosting environments, applications or other third-party products.
The PHP development team made clear that temporary mitigations were not a complete substitute for installing the security updates. The appropriate response depends on the system, the PHP version, its configuration and the vendor guidance applicable to the installation.
Were Hackers Already Exploiting the PHP Vulnerabilities?
Reports of potential exploitation added urgency to the response, although assessments differed between organisations and countries.
Reuters reported that Cloudflare had observed early attacks emerging in connection with the vulnerabilities. Security researchers also warned that attackers could attempt to reverse-engineer the publicly released fixes to identify weaknesses in systems that remained unpatched.
In contrast, Australia’s cyber agency said it was not aware of active exploitation at the time covered by Reuters’ report. The US Cybersecurity and Infrastructure Security Agency (CISA) similarly stated in its advisory that it had not observed exploitation when its guidance was published, while warning that unpatched systems remained at risk.
These statements are not necessarily contradictory: agencies and providers may have different visibility into attacks, and their assessments refer to particular times and systems. They do not establish that every affected organisation was compromised.
The incident reinforces the importance of maintaining an accurate inventory of software, monitoring systems for suspicious activity, and having a tested process for emergency updates. Organisations should also consider how they would communicate with customers if a security incident required a website to be temporarily unavailable.
What Does the Incident Mean for Businesses and Digital Services?
The PHP vulnerabilities demonstrate how a weakness in a widely used software component can create risks across organisations that have no direct relationship with one another. A single programming language may underpin websites belonging to businesses, public authorities, hospitals and international technology services.
For businesses, the immediate priority is to establish whether their websites or applications use affected PHP installations and ensure that the appropriate fixes have been applied. Organisations relying on external hosting providers should confirm who is responsible for updating the underlying software rather than assuming that the task has already been completed.
The incident also highlights the need for clear responsibilities between technical teams, management and third-party suppliers. Emergency patching can involve operational decisions about service availability, customer communications, testing and recovery. Taking a service offline may temporarily affect customers, but leaving a vulnerable system exposed can carry greater risks.
Developing expertise in IT and Computer Science, Artificial Intelligence (AI) and Safety and Security can help organisations understand software vulnerabilities, assess cyber-security risks and improve incident-response planning. Businesses reviewing their wider technology governance may also find relevant professional development through Management and Project Management training.
The priority remains practical risk reduction: identify affected systems, apply the official fixes, verify that updates are working, and investigate any indications of compromise. Training can support these capabilities, but it does not replace technical remediation or the security guidance issued by software developers and national cyber-security authorities.
What Happens Next in the Global Cyber-Security Response?
The immediate response will depend on how quickly organisations deploy the patches, verify their systems and restore services that were taken offline.
OpenAI said its Patch the Planet initiative brought together software maintainers, researchers, security providers and government partners to help coordinate responses to vulnerabilities affecting widely used software. The company outlined a process involving validation of the flaw, development and testing of fixes, preparation by affected organisations, coordination with relevant authorities and public guidance once patches become available.
The episode also raises longer-term questions about how the technology industry prepares for vulnerabilities discovered using increasingly capable AI systems. As AI tools become more effective at analysing software, organisations may need to improve their vulnerability-management processes and prepare for a faster cycle between discovery, disclosure and attempted exploitation.
For now, the PHP developers’ advice is clear: apply the available security updates. The NCSC and other cyber-security authorities have similarly urged organisations to identify affected systems and act promptly.
The global website outages show that protecting digital services requires cooperation among software maintainers, technology companies, public authorities and the organisations that operate websites. Although taking services offline can cause disruption, timely remediation and effective monitoring are essential to reducing the risk of a wider cyber-security incident.