PHP: What is it and why did it spark a global cyber security scramble? - BBC News (https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) (https://www.bbc.com/news/articles/c3qjnwye0ep5o) (https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) (https://www.bbc.com/news/articles/c3qjnwye0ep5o) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-36.413a37b227.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-48.010dc96bcf.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-57.1fcd0dc805.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-60.52f68a148f.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-72.f155fdb25f.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-76.cb5ee392d4.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-96.35ee2d1e20.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-114.7ccdf53cba.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-120.73e20442a9.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-128.060d346f09.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-144.e08bc23631.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-152.4de1981be0.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-180.1a18cb7b72.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-192.3ac042fa43.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-384.728e3a03d3.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-512.685da29e9e.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/favicon/news/favicon-16.8a240ceacc.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/favicon/news/favicon-32.5cf4e6db02.png) (../../../static.files.bbci.co.uk/core/manifest.11b0cb15658c4719a2c19e25644577223adaa7b2.json) (https://www.bbc.com) BBC Homepage (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#main-heading) Skip to content (https://www.bbc.co.uk/accessibility/) Accessibility Help (https://account.bbc.com/account?lang=en-GB&ptrt=https%3A%2F%2Fwww.bbc.co.uk%2Fnews%2Farticles%2Fc3qjnwye0ep5o) Your account (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#global-navigation-more-menu) More menu (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#global-navigation-more-menu) More menu (https://www.bbc.com/search?d=NEWS_GNL) Search BBC (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#more-menu-button) Close menu (https://www.bbc.co.uk/news) BBC News (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#product-navigation-menu) Menu (https://www.bbc.co.uk/news) Home (https://www.bbc.co.uk/news/topics/cmj34zmwm1zt) Climate (https://www.bbc.co.uk/news/world) World (https://www.bbc.co.uk/news/world/us_and_canada) US & Canada (https://www.bbc.co.uk/news/uk) UK (https://www.bbc.co.uk/news/business) Business (https://www.bbc.co.uk/news/technology) Tech (https://www.bbc.co.uk/news/science_and_environment) Science (https://www.bbc.co.uk/news/entertainment_and_arts) Entertainment & Arts (https://www.bbc.co.uk/news/health) Health (c3qjnwye0ep5o@at_medium=RSS&at_campaign=rss.html#product-navigation-more-menu) More (https://www.bbc.co.uk/news/in_pictures) In Pictures (https://www.bbc.co.uk/news/bbcverify) BBC Verify (https://www.bbc.co.uk/news/newsbeat) Newsbeat (https://www.bbc.co.uk/news/business) Business (https://www.bbc.co.uk/news/topics/cgmlnmr3yjzt) New Tech Economy (https://www.bbc.co.uk/news/topics/ce1qrvleleqt) Artificial Intelligence (https://www.bbc.co.uk/news/topics/cw9l5jelpl1t) Technology of Business (https://www.bbc.co.uk/news/topics/cyq54q01grmt) Africa Business (https://www.bbc.co.uk/news/topics/cw9nelz7j32t) Paths to Success What is PHP and why did it spark a global cyber-security scramble? (A stock picture showing a laptop with some hands tapping keys with neon lighting) Image source, Getty Images By Osmond Chia Business reporter Published 22 October 2026, 04:48 BST Updated 3 hours ago For more than a decade, serious flaws had gone undetected in the technology underpinning much of the internet. It took artificial intelligence (AI) to bring them to light and caused a global cyber-security alert. The vulnerabilities lie within a programming language called PHP, which has been used internationally since the 2000s to build websites. Governments and cyber-security agencies around the world are scrambling (https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o) to contain the fallout of the discovery on Wednesday, and have urged website operators to install a new emergency fix or consider taking their platforms offline. Cyber-security firm Wiz - one of the companies whose researchers uncovered the vulnerabilities - described the flaws as the "most severe" ever detected by AI. OpenAI, whose technology was used to find the flaws, called the discovery "one of the most impactful security issues in recent memory". What is the flaw? Most people may not have heard of PHP, but they probably interact with it daily. Short for PHP: Hypertext Preprocessor, it powers a vast number of platforms, including online shops, Wikipedia and WordPress – the content management system behind many websites like blogs. When you visit a website like Wikipedia, PHP is the code that collects information you need and presents it in a way you can read on the web, Paul Spain, chief executive of Gorilla Cyber Security, told the BBC. But due to a flaw that could allow attackers to take control of affected web servers without authentication and steal sensitive data, everything built on PHP was left exposed. AI could make such attacks easier and faster, Spain said, estimating that the flaw could affect "millions and millions" of websites. It would be "disastrous" if hackers or countries weaponised the flaw and seized private data from websites, said cyber-security researcher Jill Slay from the University of Adelaide. What websites have been affected? The alert has disrupted services globally, from gaming platforms to government portals and online forums. That includes Wikimedia - the organisation behind the online encyclopaedia Wikipedia - which took down a number of its systems as a precautionary measure. Sites and pages have been taken offline by the Finnish government, Edinburgh council and the BBC, with the Netherlands' cyber-security agency also pulling its website. (The University of Geneva's website is taken offline following a call from the European Computer Emergency Response Team (CERT-EU) after a vulnerability was discovered, in Geneva, Switzerland, 21 October 2026.) Image source, EPA Image caption, Websites like the University of Geneva's were taken offline on Wednesday A number of Scotland's public organisations, including councils and health boards, have also taken their websites offline. Some experts warn the vulnerability could leave poorly maintained websites, particularly those belonging to smaller organisations with limited security resources, at greater risk. More attempts to exploit these flaws are likely in the coming weeks since the technical details are now being made public, cyber-security researcher Salil Kanhere from UNSW Sydney said. What happened after the flaws were exposed? Developers of the PHP platform on Wednesday rolled out patches to fix the vulnerabilities that had been lurking in their software for years. "All PHP users are strongly encouraged to update immediately," the company said. Authorities and security organisations around the world have echoed those warnings to website operators to secure their platforms. The US National Security Agency told all organisations that use PHP to take their systems offline if they were unable to patch them immediately, adding that the flaw could provide a "direct path" to exploit a system's database. "These risks are serious enough to require immediate patching across United States Government departments and agencies," the agency said. The UK's National Cyber Security Centre gave similar advice and told organisations to check for "backdoors installed by an attacker". Its counterparts in the EU, Singapore and Australia have also issued similar alerts. Japanese Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP. (Sanae Takaichi, Japan's prime minister, delivers a policy speech during an extraordinary session at the lower house of parliament in Tokyo, Japan, on Monday, Oct. 5, 2026.) Image source, Bloomberg via Getty Images Image caption, Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP "We have an urgent request for everyone to take action tonight," Takaichi wrote on X. "If it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk," she said. Tech companies are also racing to secure their systems. E-commerce giant Amazon said it was targeted in multiple attempts days before the public disclosure of the PHP issue. It is unknown how the potential attackers knew about the vulnerability. How is AI finding weak spots? The vulnerabilities were found by researchers at the security firms Calif and Wiz. The researchers used advanced AI tools that are able to analyse code and find flaws much faster than humans or older systems can. "Modern software is incredibly complex, and some vulnerabilities can remain undetected for years," Kanhere said. "The underlying bugs weren't new; what changed was our ability to find them," Kanhere said. Details of the discovery leaked online this week, forcing the PHP platform's developers to rush out its announcement of the security flaw and its huge scale. The incident "highlights how AI can uncover security flaws" but also how it can "help attackers rapidly develop offensive tools and exploits," OpenAI said in a blog post. The ChatGPT-maker said it had released a program to check if the PHP platform is secure. "Many of these flaws stem from the way software were built in the past, which were built for functionality and not with security in mind," said Ryan Ko, at the University of Queensland's Cyber Research Centre. What can people do to safeguard themselves? Website owners are being urged to secure their websites with the latest version of PHP. The PHP software patch is a small, routine fix for most tech teams, Spain said. The US National Security Agency has urged "heightened awareness" in the coming weeks and to closely monitor updates from software vendors. "Vigilance in applying patches related to those systems is paramount," it said. The onus lies mainly on website operators, but users should stay alert for any security advice issued by affected services, such as requests to change passwords, Kanhere said. He warned people to be alert to any phishing messages exploiting the publicity around the incident too. (https://www.bbc.co.uk/news/articles/cme3xl7d18z2o) King warns malicious online actors are evolving tactics Published 10 October (https://www.bbc.co.uk/news/articles/cq5ynx0rvexno) Make sure use of AI is safe, data watchdog warns Published 12 October (A green promotional banner with black squares and rectangles forming pixels, moving in from the right. The text says: “Tech Decoded: The world’s biggest tech news in your inbox every Monday.”) (https://www.bbc.co.uk/newsletters/zxh6cxs) Sign up for our Tech Decoded newsletter to follow the world's top tech stories and trends. (https://cloud.email.bbc.com/techdecoded-newsletter-signup) Outside the UK? Sign up here . Related topics (https://www.bbc.co.uk/news/topics/c4nrdv135zet) International Business (https://www.bbc.co.uk/news/topics/cp3mvpdp1r2t) Cyber-attacks (https://www.bbc.co.uk/news/topics/cz4pr2gd85qt) Cyber-security (https://www.bbc.co.uk/news/topics/ce1qrvleleqt) Artificial intelligence (vertical video collection) The video playlist Watch our pick of standout clips from across the BBC Previous Next 1:28 Dame Judi Dench: 'I can't do a play, a film or read' 00:01:28, play video Dame Judi Dench: 'I can't do a play, a film or read' (Dame Judy Dench has short white hair and wears a white shirt with a blue jumper) 1:23 Warning to anyone with credit card debt. 00:01:23, play video Warning to anyone with credit card debt (A man with short dark hair wearing headphones talks into a microphone) 1:11 Don't Stop Believin'- Glee set for a reboot. 00:01:11, play video Don't Stop Believin'- Glee set for a reboot (Members of the original cast of glee singing in a classroom.) 1:04 Why have websites around the world been taken down? 00:01:04, play video Why have websites around the world been taken down? (Dark screen with hands typing on a computer laptop) 1:01 Like 'weeing lava': living with chronic UTIs. 00:01:01, play video Like 'weeing lava': living with chronic UTIs (Woman in pink hoodie bent over in pain) 1:09 'I started ketamine at 14 and needed nappies at 22' 00:01:09, play video 'I started ketamine at 14 and needed nappies at 22' (Megan has long, wavy reddish brown hair. She is wearing glasses, a white and blue top, and is smiling at the camera. She is sat on a dark leather chair, with a window and white walls in the background) 0:54 Wanted man arrested over $126m US postal fraud case. 00:00:54, play video Wanted man arrested over $126m US postal fraud case (Man in a grey t-shirt and a white face-mask on with handcuffs being led by two other people.) 1:04 Midweek meal: Tandoori salmon traybake. 00:01:04, play video Midweek meal: Tandoori salmon traybake (Salmon and potatoes in a white dish) 1:35 Can a giant tunnel save Windermere? 00:01:35, play video Can a giant tunnel save Windermere? (View of Lake Windermere, surrounded by green trees and hills.) 0:32 Aberfan falls silent to mark anniversary. 00:00:32, play video Aberfan falls silent to mark anniversary (A woman in a blue coat with a handkerchief to her eye. A man is consoling her while holding a purple umbrella) 0:53 Man found guilty of animal cruelty after stealing flamingo. 00:00:53, play video Man found guilty of animal cruelty after stealing flamingo (A man standing in a lift holding a flamingo by its neck) 0:52 Rescue operation to save shark trapped in South Korean canal. 00:00:52, play video Rescue operation to save shark trapped in South Korean canal (Shark swimming in South Korean harbour with crowd watching.) 1:13 Aberfan survivor recalls moment of the disaster. 00:01:13, play video Aberfan survivor recalls moment of the disaster (Black and white picture of a young boy in school uniform looking to camera) 0:49 Christina Applegate says she was wrongly diagnosed with MS. 00:00:49, play video Christina Applegate says she was wrongly diagnosed with MS (Christina Applegate looks into camera with wavy blonde hair wearing a suit jacket.) 1:21 Australian MP loses both legs after alleged car attack, husband says. 00:01:21, play video Australian MP loses both legs after alleged car attack, husband says (Phil Haines speaking to the press wearing a white, open-collared shirt) 1:12 What to know about the Jackdaw deal. 00:01:12, play video What to know about the Jackdaw deal (Wide shot showing the Jackdaw field) 0:40 Orionid meteor shower set to peak. 00:00:40, play video Orionid meteor shower set to peak (Lights in the sky over a building) 0:49 Le Sserafim on changing their shows for every city they visit. 00:00:49, play video Le Sserafim on changing their shows for every city they visit (Two women dressed as princesses sing on stage) Top stories (https://www.bbc.co.uk/news/live/ckgel5xp2xv9t) Live. Cyber-security issue hitting sites worldwide prompts 'millions' of hacking attempts 24416 viewing 24k viewing (https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) What is PHP and why did it spark a global cyber-security scramble? Published 3 hours ago (https://www.bbc.co.uk/news/articles/cm4g1p347qgxo) Barclays cutting 5,000 jobs as it increases reliance on AI Published 39 minutes ago More to explore (https://www.bbc.co.uk/news/articles/cqlye4v721nwo) Diabetes and ADHD drugs to be tested on Alzheimer's patients in new study (Steve and Angela Bucksey sit side-by-side smiling - Steve has grey hair and is wearing a light blue shirt with a collar, and Angela has shoulder-length greyish hair and wears a green round-necked T-shirt and a necklace) (https://www.bbc.co.uk/news/articles/c69wzv5pg447o) Only one female scientist named in GCSEs, research finds (A black and white photo shows Franklin looking down through a microscope in a lab indoors in 1955.) (https://www.bbc.co.uk/news/articles/c6n049gg75r4o) Airbnb hosts can no longer make guests strip beds and wash dishes under new rules (A woman with red nail polish stands over the sink washing a yellow plate. She is wearing a patterned top and can only be seen from her waist to her shoulders.) (https://www.bbc.co.uk/news/articles/ck3r5jw78dw3o) Want to look confident when you speak? It's all in the eyebrows (Two Ai generated close-up image of the same man. His expression is neutral on the left, and on the right his eyebrows are raised) (https://www.bbc.co.uk/news/articles/cmzxj4e8w44vo) Better weather, pay, more opportunities: Why graduates are ditching the UK to move abroad (From left to right, Charlie West, Rachel James and Owein Iveson) (https://www.bbc.co.uk/news/articles/cw4g1j05028mo) Pumpkin patch family rejects 'worst in UK' claim (A variety of different types of pumpkins positioned on or next to a hay bale) (https://www.bbc.co.uk/news/articles/cm0j0d8p4lj7o) Daughter of woman killed by partner 'refuses to be another victim' (Keeley smiling. She is wearing a pink shirt with the Kappa symbol on it. She has long fair hair.) (https://www.bbc.co.uk/news/articles/cwly3g0g371go) Chronic UTIs affect millions in the UK - these women are out to end the stigma (Young woman with long blonde hair smiling, wearing a black dress, with green foliage in the background.) (https://www.bbc.co.uk/newsletters/zgmn46f) US Politics Unspun: Cut through the noise with Anthony Zurcher's newsletter (A cut of of Anthony Zurcher wearing a suit and tie in front of a red, black, grey and blue graphic background featuring the US Capitol Building) Elsewhere on the BBC (https://www.bbc.co.uk/iplayer/episodes/b0b7r2k6/watch/p0pgl3qg?at_mid=cLyq1GTtkA&at_campaign=BBC_Trailer_Mortimer_and_Whitehouse_Gone_Fishing_S9&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=iplayer&at_brand=b0b7r2k6&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=BBC_Trailer_Mortimer_and_Whitehouse_Gone_Fishing_S9&at_bbc_team=BBC) First look: Bob and Paul cast off for a new adventure (Mortimer & Whitehouse: Gone Fishing) (https://www.bbc.co.uk/sounds/play/p0phg39g?at_mid=lmXZflLuUx&at_campaign=The_Martin_Lewis_Podcast_Question_Time_19th_Oct&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=sounds&at_brand=p02pc9xt&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=The_Martin_Lewis_Podcast_Question_Time_19th_Oct&at_bbc_team=BBC) Martin Lewis answers your big money questions () (https://www.bbc.co.uk/iplayer/episode/m00304f5?at_mid=cDXPjHDyO7&at_campaign=Blue_Lights_S4_E1&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=iplayer&at_brand=p0f2cxpr&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=Blue_Lights_S4_E1&at_bbc_team=BBC) The new series of the Bafta-winning police drama is here (Blue Lights) (https://www.bbc.co.uk/sounds/play/m00334q7?at_mid=rPrRh6uOPB&at_campaign=The_History_Podcast_How_Houdini_Made_Magic&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=sounds&at_brand=m001z66c&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=The_History_Podcast_How_Houdini_Made_Magic&at_bbc_team=BBC) Derren Brown unlocks the extraordinary world of Harry Houdini (The History Podcast: How Houdini Made Magic) Most read 1 (https://www.bbc.co.uk/news/articles/c6ly09v09lnjo) Dame Judi Dench: 'I can't do a play, a film or read any more' 2 (https://www.bbc.co.uk/news/articles/cm4g1p347qgxo) Barclays cutting 5,000 jobs as it increases reliance on AI 3 (https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) What is PHP and why did it spark a global cyber-security scramble? 4 (https://www.bbc.co.uk/news/articles/c6jrw03njgxzo) The four locations in the running to be UK City of Culture 2029 5 (https://www.bbc.co.uk/news/articles/c69wzv5pg447o) Only one female scientist named in GCSEs, research finds 6 (https://www.bbc.co.uk/news/articles/c6n049gg75r4o) Airbnb hosts can no longer make guests strip beds and wash dishes under new rules 7 (https://www.bbc.co.uk/news/articles/cq8jzrxlkmwmo) Legendary video game studio BioWare closed after 31 years 8 (https://www.bbc.co.uk/news/articles/cx8dzrp768j8o) How Arab parties could hold critical balance of power in Israeli election 9 (https://www.bbc.co.uk/news/articles/cr74p0zkd4jjo) Tougher punishments for criminals who refuse to attend sentencing backed by victim's family 10 (https://www.bbc.co.uk/news/articles/cm98zn5j89kdo) Rosenberg: Russia agrees to Ukraine talks but sees little to talk about in new peace push BBC News Services (https://www.bbc.co.uk/news/10628994) On your mobile (https://www.bbc.co.uk/news/help-50068132) On smart speakers (https://www.bbc.co.uk/news/10628323) Get news alerts (https://www.bbc.co.uk/news/20039682) Contact BBC News (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (https://www.bbc.co.uk/usingthebbc/terms) Terms of Use (https://www.bbc.co.uk/aboutthebbc) About the BBC (https://www.bbc.com/usingthebbc/privacy) Privacy Policy (https://www.bbc.com/usingthebbc/cookies) Cookies (https://www.bbc.co.uk/accessibility) Accessibility Help (https://www.bbc.co.uk/iplayer/guidance) Parental Guidance (https://www.bbc.co.uk/contact) Contact the BBC (https://www.bbc.co.uk/careers) Careers (https://www.bbc.co.uk/bbcnewsletter) BBC emails for you (https://www.bbc.com/advertisingcontact/) Advertise with us Copyright © 2026 BBC. The BBC is not responsible for the content of external sites. (https://www.bbc.co.uk/editorialguidelines/guidance/links-and-feeds) Read about our approach to external linking. ()