PHP security issue LIVE as websites taken offline amid cyber

Websites are being taken down over a cyber security issue after a researcher using AI discovered a “critical security issue” in a programming language.

The security issue identified by the researcher could allow attackers to remotely control any web servers running the widely used programming language, PHP.

PHP is used by almost 70 per cent of websites, according to cybersecurity firm Cloudflare, and underpins popular platforms such as WordPress and Magento.

Downing Street said on Thursday that some “limited” government services may temporarily be offline while work is carried out to address potential cybersecurity issues.

According to Cloudflare chief executive Matthew Prince, there was a dramatic surge in attempts to exploit the issue once it was announced.

He wrote on X: “Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”

Follow live updates in the blog below

Warning over Russia and China

Former Government Communications Headquarters (GCHQ) chief Sir David Omand warned that Russia and China will be exploiting the PHP bug.

Asked whether the two countries will have mobilised resources to exploit the issue, he told Times Radio: “Certainly both, and straightforward criminal gangs, just simply looking for acquisitive gain, or to launch ransomware attacks and so on.”

He added: “The targets that they will be most looking for are not the 30 million websites of small and medium-sized enterprises but nonetheless, I’ve no doubt they will be thinking of how would we exploit this vulnerability before everyone finally gets patched.”

Taking systems offline is "responsible precaution", says security expert

Beverley Griffiths, senior lecturer in security and resilience at Bucks New University, insists the Government is right to take their services offline amid a PHP cybersecurity issue.

She said: “Taking systems temporarily offline can be a responsible precaution when a serious security vulnerability is identified. It allows organisations to put protective measures in place and reduce the risk of systems being compromised.

“The challenge is balancing security with the need to keep essential services running. Cyber resilience isn’t just preventing attacks; it’s being prepared to respond to threats, managing disruption and restoring services safely.”

Flaw discovered back in August

The Wall Street Journal had reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

Professor Woodward explained the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting this security flaw would be “too complicated”, and nothing was done.

“People have been scrambling away, saying, ‘Well, actually, yes, you can exploit it, and we now need to patch it’,” he said.

“And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place.”

"The cat was let out of the bag earlier than it was supposed to have been"

Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said “the cat was let out of the bag rather earlier than it was supposed to have been”.

“There’s always a window between the flaw being publicly known and it being patched so that the attackers can’t successfully get in,” Professor Woodward told BBC Radio 4’s Today programme.

“And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.

“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.”

NCSC advice to mitigate risk

The NCSC recommends that to mitigate any vulnerabilities, organisations shfollow these priority actions:

Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions; identify PHP installations generally and assess their exposure to CVE-2026-109618 and CVE-2026-109619.

Update to the latest version of PHP and continue to monitor for future updates.

If you are unable to update to a version with the security update applied, the PHP Foundation have provided temporary mitigations.

If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.

If you are unable to update or disable the system immediately then you should assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker. If you are not confident in your ability to do this yourselves then you can get assistance from an NCSC-assured Cyber Incident Response provider.

Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP. NCSC-NL have published an inventory list of software products with a PHP dependency potentially affected by the vulnerabilities. Apply relevant updates as they become available.

What are the two critical vulnerabilities?

The NCSC has explained what the critical vulnerabilities are with the PHP system.

It says that the security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption.

Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.

The two vulnerabilities are:

CVE-2026-109618 : Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.

CVE-2026-109619 : Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

'Expect more of this'

A cyber security expert has warned that some websites may have been affected before new security advice was issued and said that we should expect "more of this" to come due to the use of AI.

Dr Mohamed Chahine Ghanem, associate professor and cyber security research lead at Keele University, said: “What we are seeing is a global, coordinated emergency patch of the plumbing underneath much of the web. These two flaws sit in PHP itself rather than in any single application, so the exposure runs from council websites to online shops. An attacker who succeeds can run their own code on the server and reach the files and databases behind it.

“The NCSC’s advice to update or take systems offline was right. Councils and public bodies that pulled their sites acted responsibly, and that should not be read as evidence that they were hacked. As of today there is no confirmed compromise of a UK organisation. But Amazon has reported exploitation attempts from 17 October, before the flaws were public, so the honest position is that some systems may have been probed before anyone could patch them."

He said the "wider lesson" is AI, which made the security flaws easy to find and exploit. "Expect more of this," he warned. "For the public, the risk is follow-on fraud: be wary of unexpected messages that cite this incident, and never hand over card or login details."

Security flaw 'being broadly exploited'

Thousands of attempts at exploiting the security vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.

In an update published on the Amazon Web Services’ security blog, the company said its threat intelligence team found the flaw was “now being broadly exploited in the wild”.

Cloudfare chief executive Matthew Prince said on Thursday the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.

Security flaw reportedly discovered in August

Organisations are being urged to update their software to a new version, or consider taking their websites offline if they can't do so immediately.

The cyber division of the National Security Agency in the US warned weaknesses in the software could provide “a direct path to the server’s file system or database”.

The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.

OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers working to address the critical flaw in PHP, and supported its developers as it led the fixes.

"Unprecedented" incident, says technology boss

Olly Whitehouse, the chief technology officer for the UK's NCSC, has said the scale of this week's incident is "unprecedented" while speaking to BBC Radio 4's World at One.

He said: "It will be universally felt, I suspect."

On the possibility this flaw has been used by hackers, he says there are "no indications" at the moment of "any successful breaches", the BBC reports .

Without specifying any organisations, he says the NCSC is "starting to see positive confirmation" that advice sent to those affected has been received and is being acted on.

And when asked if there will be more events like this, he says it is "reasonable to expect that this will not be the last".

Cyber security expert weighs in

Dr Mohamed Chahine Ghanem, Associate Professor and Cyber Security Research Lead at Keele University, said: “What we are seeing is a global, coordinated emergency patch of the plumbing underneath much of the web.

"These two flaws sit in PHP itself rather than in any single application, so the exposure runs from council websites to online shops. An attacker who succeeds can run their own code on the server and reach the files and databases behind it.

“The NCSC’s advice to update or take systems offline was right. Councils and public bodies that pulled their sites acted responsibly, and that should not be read as evidence that they were hacked.

"As of today there is no confirmed compromise of a UK organisation."

In a statement issued yesterday (Wednesday 21 October), the National Cyber Security Centre wrote: "The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Government "continues to monitor the situation closely"

Technology minister Baroness Lloyd of Effra said in the House of Lords: "The government continues to monitor the situation closely and work with departments to maintain the security resilience and availability of public services."

50,000 alerts sent to businesses

Around 50,000 alerts were sent to businesses before the flaw emerged, the BBC reports.

"The government acted proactively ahead of public disclosure," Baroness Lloyd of Effra has said in the House of Lords.

Departments were "alerted to the vulnerability and advised to identify potential affected systems, assess their exposure, and prepare to implement mitigations and security updates".

She said the National Cyber Security Centre (NCSC) was "able to make 50,000 proactive notifications to the wider economy to advise business and other organisations on what actions they should take".

Has the system been hacked?

It is understood that online Government services have been taken down as a "precaution" in order to fix the security issue that was highlighed on Wednesday.

Speaking in the House of Lords on Thursday, tech minister Baroness Lloyd of Effra said: “The information I have is that 32 Government services are unavailable and four are partially unavailable.”

She said that “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied”.

The Downing Street spokeswoman told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out."

Confirming that there was no hacking incident, they continued: "But this does not mean they were hacked, and work continues to resolve any issues.”

For those who might not have heard of PHP before, it is short for PHP: Hypertext Preprocessor. It is an open-source, back-end programming language which runs on a web server.

It powers many widely used platforms including Wikipedia, online shops, and WordPress among others. When a user visits a website, PHP is the code which collects data and effectively turns it into a page you can read.

According to Wiz, a cyber-security firm which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites.

Budget week not thought to be affected by security incident

The security of week’s Government Budget has not been compromised by a critical security flaw in a programming language used by the majority of websites, a minister has said.

Scotland Secretary Douglas Alexander was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website.

Mr Alexander told Times Radio on Thursday morning: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.

“Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.”

Last year, the OBR’s Budget analysis was mistakenly published online ahead of then-chancellor’s Rachel Reeves statement to the Commons, allowing for early access to market sensitive information.

What has the Government said?

Downing Street said today that no large UK public-facing critical services have been affected, but some “limited” Government websites have gone dark while the issues are resolved.

A Government spokesperson said: “Work is already under way across Government to actively identify and patch any potential exposure.

“We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”

Speaking in the House of Lords, Baroness Lloyd of Effra says the number of government services that are unavailable has "largely resulted" from precautionary measures taken to protect systems while updates and mitigations are applied.

They are working closely with departments to "restore the services safely and securely", she adds. The advice is to mitigate then restore the services, which they are doing as quickly as possible, the minister adds.

We have put together some of the key points from the cyber incident so far which includes:

A "critical security issue" has been flagged within PHP, which is used across many UK organisations

Due to the security concerns, organisations have been urged to temporarily take down their websites while a solution is found

As of around midday, 32 Government services are reported to have been taken down

MOT testing services affected by cyber incident

An outage affecting MOT testing services in the UK was related to the PHP cyber incident, it is understood.

The DVSA system, through which garages log their MOT records after testing vehicles, started experiencing issues yesterday afternoon until the issue was resolved this morning, according to the DVSA website.

Instead of filing information through the DVSA website, garages were instructed to use a paper system and upload the data at a later date, meaning tests could continue as normal during the outage.

An update on the DVSA website at 11.34am on Thursday said the incident had been resolved.

'Cyber equivalent of an unexploded bomb'

Zoe Kleinman, the BBC's technology and AI editor, said the PHP issue feels "like the cyber equivalent of an unexploded bomb".

"I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet," she wrote. "There has been no painful attack like the ransomware we saw knock out M&S and JLR in 2025. But the potential threat is so serious that websites around the world have been taken down as a precaution."

She said weaknesses in the PHP programming language have been 'quietly resting' for years.

Expert explains why cyber security issue is 'serious'

An expert has warned that the issue is "serious".

Speaking to BBC Radio 4’s Today programme, Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), explained: “It’s serious because of the scale of it and also the nature of it. We’re talking something like 30 million websites out there – we’re certainly getting off of that number – but also the nature of it."

He added: “It’s not just the the vast volume of websites that use it, but this is called a remote code execution vulnerability, and what that means is an attacker can get their own code onto the web server and run it, and basically do whatever they like. They can steal data, they can go to other parts of your network, all sorts of things like that. Even plant the backdoor to get in later on, so you can see, pretty serious.”

UK government services offline amid security issue

Thirty-two Government services are offline and four are partially unavailable amid the PHP cyber security issue, a minister has said in the House of Lords.

Downing Street said that some “limited” Government services may temporarily be offline while work is carried out to address potential cybersecurity issues.

Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites.

No large UK public-facing critical services have been affected, a No 10 spokeswoman said on Thursday.

The official told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue."

They added: “No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues.”

On Wednesday, a researcher using AI discovered a “critical security issue” in a programming language.

The security issue identified by the researcher could allow attackers to remotely control any web servers running the widely used programming language PHP, which is used by almost 70 per cent of websites, according to cybersecurity firm Cloudflare.

PHP underpins popular platforms such as WordPress and Magento.

Organisations have been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the software.

If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.