PHP security crisis live

As we near the end of the working day here in the UK, a quick reminder of what we've seen today...

Companies across the world have been scrambling to update and patch any websites running PHP, a programming language thought to support around 70% of sites online today, including WordPress sites

The patch addresses a potential security flaw which could allow hackers to gain access to affected web servers without authentication and steal sensitive data

While there hasn't been any confirmed news of any cyberattacks, many sites have been forced offline or taken down temporarily as owners apply the update

Government sites and Wikipedia were among the most high-profile entities affected, but most are now back online

We'll continue to monitor for any further developments, but in the meantime, stay safe and get those updates installed!

And if you're a slightly bigger business, we've had some advice sent in from Kara Sprague, CEO of HackerOne, on the security steps to take.

Sprague advises companies should:

Strengthen your vulnerability disclosure process . Closely monitor incoming reports and use automation to deduplicate, validate, and prioritise findings based on asset criticality and demonstrated impact. Not all remote code execution vulnerabilities carry the same risk in every environment.

Use researcher findings to inform patching priorities . Apply patches as quickly as possible, but when resources are constrained, externally reported vulnerabilities specific to your environment can help identify the most urgent exposures.

Look beyond the initial patching window . Large enterprises may have overlooked PHP installations that remain vulnerable after the first round of remediation. Once initial patching is complete, consider incentivising researchers through existing bug bounty programs to identify remaining exposures.

“Finding vulnerabilities before adversaries do is only an advantage if we can coordinate and deploy fixes quickly enough to stay ahead," she adds. "The PHP discoveries are also a reminder that open-source security is everyone's responsibility. Software that supports millions of websites cannot depend on a handful of maintainers to manage increasingly sophisticated threats alone.

What to do if you run a small business

It's all well and good looking at the impact this issue might have on government websites and major organizations, but where the effects might be felt hardest is on smaller businesses, where taking your website down for even a few hours can have a major hit on trading.

If you're an SMB owner or entrepreneur, here's what we'd advise you do ASAP:

your website host or provider - if you use an external website hosting service or provider, it might be worth contacting them to find out if your website uses PHP and if it has been affected - and what the plan to fix it is!

Make a backup of your website immediately - Users should ensure they have a reliable backup of all the information contained on their website in case the worst happens - but you should also make sure this backup can be easily restored and re-activated

Be aware of any threats over the few days - Along with keeping an eye on your own website to make sure nothing unusual happens, you should also be vigilant against security threats. Hackers and scammers often take advantage of highly-publicized incidents such as this to run phishing or other scams preying on victim's lack of knowledge and nervousness.

Fortunately, things still seem to be quiet - and often in cybersecurity, that can either be a good or bad thing.

The good news is that we don't seem to have seen any major outages or issues with popular websites or services - particularly as the US begins to wake up and log on for its working day.

The bad news, as mentioned previously, is that this might be the sort of issue which bubbles under the surface for some time, with hackers lurking and probing potential targets over the coming weeks and months...

We've got an in-depth explainer with everything you need to know the PHP2Shell vulnerability , including what it is, what websites are affected and what you can do to keep safe online.

Which major sites have been affected?

PHP code is behind something like 70% of the website we all visit, so the potential impact is huge — but which major websites have gone dark and confirmed the PHP vulnerability to be the main cause?

We've put together a full list of the most notable sites affected so far , from Wikipedia to the Internet Archive. A recent addition, as we mentioned below, is Orange Telecom, while in the UK a government minister has revealed that 32 government services are offline as a result of the PHP security threat. Yikes.

Some UK government services affected

The BBC has reported that the UK government is claiming "some" limited government services "may be offline" while security work is being carried out.

There's no specific information on what has been affected, apart from the fact that no large UK public-facing critical services were hit.

It adds that work to identify and fix potential exposures to UK government system is underway, with experts "working closely with OpenAI and international partners."

Orange suspends some websites and apps

We've been waiting for a big company to reveal some details their response to PHP, and now Orange appears to be the first.

The French telecoms giant has confirmed it "suspended access" to several websites and apps as a "precautionary measure", apologizing for any impact.

"Following the publication on 21 October of several security vulnerabilities affecting PHP, a programming language used by many websites and applications around the world, Orange has decided to temporarily suspend access to certain services," the company wrote.

"This decision has enabled the Group to deploy the necessary security patches and carry out the related checks before progressively restoring the affected websites and applications."

Supply chains could be another area hit by the PHP issue, as one affected company taking their systems offline could cause a butterfly effect across an industry.

“A single vulnerability can trigger a global domino effect across borders and industries within hours. What we’re seeing with PHP is a stark reminder that the global economy runs on complex, interconnected digital systems, and that hidden security weaknesses in them are now being found at unprecedented speed with the help of AI," notes Chris Dimitriadis, Chief Global Strategy Officer at ISACA.

“But the real concern isn’t just the vulnerability itself. It’s what it reveals our preparedness. Cyber resilience isn’t something organisations can switch on when a crisis hits. They need to understand where they are exposed, recognise their technology dependencies and have the right people, processes and controls in place to respond quickly and effectively.

“Technology will never be completely free of vulnerabilities. The real test is whether organisations have the governance, expertise and operational readiness to prevent a security flaw from becoming a much bigger crisis. Most of all, that means investing in the generation of cybersecurity professionals, who can use AI to find and fix weaknesses faster than attackers can exploit them.”

What role did AI - and OpenAI - play?

An interesting note the PHP flaws is that they were detected (at least partly) by AI.

Ryan Austin, the researcher at cybersecurity firm Calif who played a major role in uncovering the PHP flaw, has acknowledged the part OpenAI's systems played in revealing the issues.

Potential PHP flaws had first been spotted back in 2024 by its own researchers, but it had to wait until July 2026 before being accepted into OpenAI’s Patch the Planet initiative , which looks to use advanced AI systems to detect and solve cybersecurity issues.

Calif, which was part of Patch the Planet, then found a more serious issue in PHP in August 2026, which was spotted by OpenAI's own systems shortly after, before the group began working on a fix.

"Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications," OpenAI's blog post noted.

"Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."

Who has been affected so far?

With an issue as widespread as this (some reports are claiming around 70% of the web as we know it could be affected) it's tricky to list all the affected sites and businesses - mainly because many won't want to admit to any security shortcomings.

Thanks to Reuters , we do know that several European governments have seen some effect, although many of the sites are now back up online, including:

- The German digital ​ministry said federal IT service provider ITZBund had taken several websites offline due to ​the discovery of PHP vulnerabilities, although this was a "purely preventive" move.

- The French Interior Ministry temporarily took down the ​websites of local government administrative offices while awaiting the PHP patches - again, this was a preventive measure.

- Belgium's foreign ministry temporarily took its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although this was not confirmed.

- In the Netherlands, the nation's National Cyber Security Centre ​took its public-facing sites offline, along with those belonging to the Port of Rotterdam, the Dutch national football association KNVB, the ‌websites of ⁠the five largest political parties and numerous hospital websites across the country.

"A finite window" to patch and protect

This is clearly an alarming issue, one which will likely affect companies of all sizes across the globe, so how quickly should businesses look to respond?

"This is a stake-in-the-ground moment for CISOs around the world," says Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.

"Organisations of every size have a finite window to shore up their cyber defences, because threats now operate at machine speed. Patch fast, know your attack surface and limit the blast radius, because that window is closing. If we don't act now, we will see more organisations forced to take their sites offline while they scramble to fix what should have been secured long ago."

The issue may raise wider concerns the role of open source software in propping up some of the most integral parts of the global information network - as the very thing that makes it so unique also leaves it vulnerable to flaws and security concerns.

"Much of the critical software running the world is also the least visible. Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," says Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.

"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."

"The ripple effects from vulnerabilities in foundational software like PHP can extend across entire industries. This makes it critical to have a trusted software source that helps manage this risk and, ideally, quickly responds to these new threats as they emerge."

PHP fixes are out now - so get patching

As we've covered on TechRadar Pro this morning, PHP has now released its emergency fixes for users to download .

The issues are listed as CVE-2026-109618 and CVE-2026-109619 - the former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).

The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.

Wondering how this affects you?

While most websites are back up and running, there were some that were taken offline yesterday after the news broke. Did you notice anything amiss? Tell us in the above, or vote in the poll to let us know what you normally do when you hear cybersecurity issues in the news.

What has actually happened?

It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.

Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources.

So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.

Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now.

PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.

PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.

News of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems .

The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.

PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."