Global Websites Offline Due to Critical PHP Vulnerabilities

What Happened

On October 22, 2026, international governments and agencies issued a critical cyber-security update, warning of two vulnerabilities in the PHP programming language that powers much of the internet.

The vulnerabilities, discovered by cyber-security researchers at Calif and Wiz, were found to be the 'most severe vulnerabilities ever discovered' in PHP, with the potential to allow hackers to remotely execute code on servers without needing a password or legitimate account access.

In response, multiple websites, including those of the Finnish government, Edinburgh council, and the BBC, were taken offline as a precautionary measure until they could be safely patched.

The US National Security Agency (NSA) issued a rare public warning, advising organizations to take their websites offline if they could not be updated immediately.

What the Evidence Establishes

The evidence establishes that the vulnerabilities in PHP are critical and could have severe consequences if exploited by hackers.

According to the PHP Foundation, the vulnerabilities are the most severe it has encountered, and the NSA has warned that they could provide a direct path to a server's file system or database.

Cyber-security experts, including Don Smith from the Sophos Counter Threat Unit, have stated that the vulnerabilities are a 'priority target' for hackers and that organizations should take immediate action to patch their systems.

The vulnerabilities have been found to affect all versions of PHP dating back to PHP 5, which was launched in 2004.

Where the Accounts Conflict

There is some conflict in the accounts of the discovery of the vulnerabilities, with the PHP Foundation stating that it was discovered by cyber-security researchers at Calif and Wiz, while Al Jazeera reports that the vulnerabilities were discovered with the help of artificial intelligence (AI) models.

Additionally, there is some uncertainty about the number of websites affected, with Wiz estimating that 'roughly 70%' of the internet is affected, although this figure has not been verified by the BBC.

The UK's National Cyber Security Centre (NCSC) has urged organizations to apply the fixes, but has not provided a specific estimate of the number of websites affected.

Context and Stakes

The discovery of the vulnerabilities in PHP has significant implications for the security of the internet, with the potential for hackers to exploit the vulnerabilities and gain access to sensitive information.

The PHP programming language is used by an estimated 70% of the internet, making it a critical component of online infrastructure.

The vulnerabilities have been found to affect not only websites but also content management systems, hosting platforms, and third-party products, making it a complex and challenging issue to address.

The stakes are high, with the potential for significant disruptions to online services and the potential for financial and reputational damage to organizations that fail to address the vulnerabilities.

What to Watch Next

Organizations and individuals should watch for updates from the PHP Foundation and cyber-security agencies, such as the NSA and the NCSC, for further guidance on addressing the vulnerabilities.

Additionally, organizations should continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP.

It is also important to be aware of the potential for phishing scams and other types of cyber-attacks that may attempt to exploit the vulnerabilities.

The situation is ongoing, and it is likely that there will be further developments in the coming days and weeks.

Bottom Line

In conclusion, the discovery of the vulnerabilities in PHP is a critical issue that requires immediate attention from organizations and individuals.

The potential consequences of not addressing the vulnerabilities are severe, and it is essential that organizations take proactive steps to patch their systems and protect themselves against potential cyber-attacks.

The situation highlights the importance of cyber-security and the need for ongoing vigilance and monitoring to protect against emerging threats.

As the situation continues to evolve, it is essential to stay informed and follow the guidance of cyber-security agencies and experts to minimize the risk of exploitation.