Race to update services' computer systems after cyber-security flaw found - BBC News (https://www.bbc.co.uk/news/articles/c9j34zgmkxx1o) (https://www.bbc.com/news/articles/c9j34zgmkxx1o) (https://www.bbc.co.uk/news/articles/c9j34zgmkxx1o) (https://www.bbc.com/news/articles/c9j34zgmkxx1o) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-36.413a37b227.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-48.010dc96bcf.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-57.1fcd0dc805.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-60.52f68a148f.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-72.f155fdb25f.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-76.cb5ee392d4.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-96.35ee2d1e20.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-114.7ccdf53cba.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-120.73e20442a9.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-128.060d346f09.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-144.e08bc23631.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-152.4de1981be0.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-180.1a18cb7b72.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-192.3ac042fa43.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-384.728e3a03d3.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/touch/news/touch-icon-512.685da29e9e.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/favicon/news/favicon-16.8a240ceacc.png) (../../../static.files.bbci.co.uk/core/website/assets/static/icons/favicon/news/favicon-32.5cf4e6db02.png) (../../../static.files.bbci.co.uk/core/manifest.11b0cb15658c4719a2c19e25644577223adaa7b2.json) (https://www.bbc.com) BBC Homepage (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#main-heading) Skip to content (https://www.bbc.co.uk/accessibility/) Accessibility Help (https://account.bbc.com/account?lang=en-GB&ptrt=https%3A%2F%2Fwww.bbc.co.uk%2Fnews%2Farticles%2Fc9j34zgmkxx1o) Your account (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#global-navigation-more-menu) More menu (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#global-navigation-more-menu) More menu (https://www.bbc.com/search?d=NEWS_GNL) Search BBC (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#more-menu-button) Close menu (https://www.bbc.co.uk/news) BBC News (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#product-navigation-menu) Menu (https://www.bbc.co.uk/news) Home (https://www.bbc.co.uk/news/topics/cmj34zmwm1zt) Climate (https://www.bbc.co.uk/news/world) World (https://www.bbc.co.uk/news/world/us_and_canada) US & Canada (https://www.bbc.co.uk/news/uk) UK (https://www.bbc.co.uk/news/business) Business (https://www.bbc.co.uk/news/technology) Tech (https://www.bbc.co.uk/news/science_and_environment) Science (https://www.bbc.co.uk/news/entertainment_and_arts) Entertainment & Arts (https://www.bbc.co.uk/news/health) Health (c9j34zgmkxx1o@at_medium=RSS&at_campaign=rss.html#product-navigation-more-menu) More (https://www.bbc.co.uk/news/in_pictures) In Pictures (https://www.bbc.co.uk/news/bbcverify) BBC Verify (https://www.bbc.co.uk/news/newsbeat) Newsbeat (https://www.bbc.co.uk/news/technology) Tech Race to update services' computer systems after cyber-security flaw found To play this video you need to enable JavaScript in your browser. This video can not be played Figure caption, How did AI discover the internet's massive cyber-security risk? By Tom Gerken and Liv McMahon , Technology reporters Published 8 hours ago Organisations and businesses are still scrambling to update their systems after cyber-security flaws were revealed in a widely-used programming language, PHP. Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said "critical vulnerabilities" were found in the back-end language, used in web development for decades. Researchers (https://www.bbc.co.uk/news/articles/cmly0lg3w5x2o) warned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched - and the UK government was among those to take some sites offline as a precaution. There have been no successful attacks reported so far, but experts say any impact may take time - even months - to become fully apparent. Downing Street said on Thursday "some" limited government services "may be offline" while security work was being carried out. "The information I have is that 32 Government services are unavailable and four are partially unavailable," tech minister Baroness Lloyd of Effra told the House of Lords. She attributed this to having "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied". The government did not specify which services were taken offline - but it said no large UK public-facing critical services had been affected. A spokesperson said work had already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue". "But this does not mean they were hacked, and work continues to resolve any issues," they added. Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), called the event "unprecedented". "It will be universally felt, I suspect," he told BBC Radio 4's World At One. But he said there were "no indications" of any successful breaches by hackers. He said the NCSC was "starting to see positive confirmation" that (https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php) advice sent to those affected, external had been received and was being acted on. (https://www.bbc.co.uk/news/articles/cw98z6qlyvg3o) Zoe Kleinman: PHP is the cyber equivalent of an unexploded bomb Published 15 hours ago (https://www.bbc.co.uk/news/articles/c3qjnwye0ep5o) What is PHP and why did it spark a global cyber-security scramble? Published 14 hours ago Cyber-security lecturer Rory Hopcraft told the BBC the government needed to make sure that its own infrastructure was up-to-date. "Hacking has been around for many years," he said. "The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point." Dean Presley, who has a garage in Chepstow, South Wales, told BBC Your Voice he had been unable to properly process MOTs online. He said his computer system had been down since Wednesday morning, and while he has experienced outages before, they have not lasted this long. "MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," Dean said. He said this has forced him to write everything on paper documents, leading to delays for customers. What is PHP? PHP stands for PHP: Hypertext Preprocessor. It's a programming language which runs on a web server, behind the scenes of a website, and effectively lets you see the sites you visit. When you go to a site, PHP is the code which collects data and effectively turns it into a page you can read. It was developed in the early 1990s to help serve dynamic web pages and applications, but still powers lots of platforms today. PHP has been used across a wide range of platforms including Wikipedia, online shops and WordPress – the system behind many websites - as well as to write tools to build web apps, with Laravel, Symfony and Drupal among popular PHP frameworks. According to (https://www.wiz.io/blog/php2shell-php-rce) cyber-security firm Wiz, external , which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites. And it said the flaws - now coined "php2shell" - were inherent in the language itself, affecting many past versions of it. The PHP Foundation, the non-profit which maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP. Some large organisations said they had seen a high volume of attempts to breach their systems. Matthew Prince, the boss of internet infrastructure firm Cloudflare, (https://x.com/eastdakota/status/2113079352682570051) wrote on X, external on Thursday that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced. "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he added. Amazon also says it saw hackers attempt to exploit the flaws, but its websites were operating as normal. 'Serious vulnerability' (OpenAI logo displayed on a smartphone) Image source, Getty Images Image caption, Cyber researchers at Calif and Wiz unearthed the php2shell flaw, theorised by the PHP Foundation in 2024, in part using OpenAI tools While the impact of the PHP flaw remains to be seen, disruption continued for businesses and organisations after many sites were taken down on Wednesday. The website of a Dutch agency specialising in cyber-security, Finland's government and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday. But a number of sites appeared to have been taken offline on Thursday, as operators rushed to check if PHP might be running within their systems or if any patches were required. In France, telecommunications company Orange (https://www.orange.com/en/press-release/orange-suspend-temporairement-lacces-a-certains-sites-et-applications-utilisant-php-514804-514804) also said, external it had suspended access to certain services globally while it deployed security fixes. According to (https://www.bbc.co.uk/news/live/ckgel5xp2xv9t?post=asset%3A88458b01-979c-4411-823f-ffa07ad9267a#post) some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches - but not as quickly as might be hoped globally. "The window to respond has shrunk dramatically," said Matt Hull, VP of cyber intelligence and response at global cyber security company NCC Group. "A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours." Hull also highlighted the extent of the task facing developers and engineers working to deal with the issue. "Several days into this incident, security professionals might already be dealing with significant burnout," he said, urging a need to "make time to rest, share the workload and look after each other". "Resilience depends on people as much as technology." (A green promotional banner with black squares and rectangles forming pixels, moving in from the right. The text says: “Tech Decoded: The world’s biggest tech news in your inbox every Monday.”) (https://www.bbc.co.uk/newsletters/zxh6cxs) Sign up for our Tech Decoded newsletter to follow the world's top tech stories and trends. (https://cloud.email.bbc.com/techdecoded-newsletter-signup) Outside the UK? Sign up here . Related topics (https://www.bbc.co.uk/news/topics/cp3mvpdp1r2t) Cyber-attacks (https://www.bbc.co.uk/news/topics/cz4pr2gd85qt) Cyber-security More on this story (https://www.bbc.co.uk/news/articles/cmx23d0k57d3o) UK working to identify exposure after global cyber-security warning Published 16 hours ago (The image shows two people from behind as they sit at a table looking at code on a laptop.) (vertical video collection) The video playlist Watch our pick of standout clips from across the BBC Previous Next 0:22 Raye wins 2026 Mercury Prize. 00:00:22, play video Raye wins 2026 Mercury Prize (Musician Raye smiles as she looks at the Mercury Prize she has just won at a ceremony.) 0:47 'I'm speechless': Olivia Dean on making UK chart history. 00:00:47, play video 'I'm speechless': Olivia Dean on making UK chart history (Olivia Dean has long, dark, curly hair and is wearing a black dress.) 0:47 Two named storms set to hit UK in coming days. 00:00:47, play video Two named storms set to hit UK in coming days (Large waves crashing over a black and white striped lighthouse at the end of a pier.) 1:23 Warning to anyone with credit card debt. 00:01:23, play video Warning to anyone with credit card debt (A man with short dark hair wearing headphones talks into a microphone) 0:43 No more bed stripping: Airbnb cuts guest chores list. 00:00:43, play video No more bed stripping: Airbnb cuts guest chores list (Woman washes a yellow plate with a green sponge in sink as water from the tap falls.) 1:06 Image of elderly couple almost naked during France riots is AI fake. 00:01:06, play video Image of elderly couple almost naked during France riots is AI fake (A fake, AI-generated image showing an elderly couple in their underwear during the French riots.) 1:04 Why have websites around the world been taken down? 00:01:04, play video Why have websites around the world been taken down? (Dark screen with hands typing on a computer laptop) 1:01 Like 'weeing lava': living with chronic UTIs. 00:01:01, play video Like 'weeing lava': living with chronic UTIs (Woman in pink hoodie bent over in pain) 1:28 Dame Judi Dench: 'I can't do a play, a film or read' 00:01:28, play video Dame Judi Dench: 'I can't do a play, a film or read' (Dame Judy Dench has short white hair and wears a white shirt with a blue jumper) 0:26 Water appears to pour from clouds above hidden cave. 00:00:26, play video Water appears to pour from clouds above hidden cave (Image appears to show water pouring from a blue sky.) 1:11 Don't Stop Believin'- Glee set for a reboot. 00:01:11, play video Don't Stop Believin'- Glee set for a reboot (Members of the original cast of glee singing in a classroom.) 1:09 'I started ketamine at 14 and needed nappies at 22' 00:01:09, play video 'I started ketamine at 14 and needed nappies at 22' (Megan has long, wavy reddish brown hair. She is wearing glasses, a white and blue top, and is smiling at the camera. She is sat on a dark leather chair, with a window and white walls in the background) 0:54 Wanted man arrested over $126m US postal fraud case. 00:00:54, play video Wanted man arrested over $126m US postal fraud case (Man in a grey t-shirt and a white face-mask on with handcuffs being led by two other people.) 1:04 Midweek meal: Tandoori salmon traybake. 00:01:04, play video Midweek meal: Tandoori salmon traybake (Salmon and potatoes in a white dish) 1:35 Can a giant tunnel save Windermere? 00:01:35, play video Can a giant tunnel save Windermere? (View of Lake Windermere, surrounded by green trees and hills.) 0:53 Man found guilty of animal cruelty after stealing flamingo. 00:00:53, play video Man found guilty of animal cruelty after stealing flamingo (A man standing in a lift holding a flamingo by its neck) 0:52 Rescue operation to save shark trapped in South Korean canal. 00:00:52, play video Rescue operation to save shark trapped in South Korean canal (Shark swimming in South Korean harbour with crowd watching.) 0:49 Christina Applegate says she was wrongly diagnosed with MS. 00:00:49, play video Christina Applegate says she was wrongly diagnosed with MS (Christina Applegate looks into camera with wavy blonde hair wearing a suit jacket.) Top stories (https://www.bbc.co.uk/news/articles/cwd094x57p32o) Prepare for supply chain disruption from cyber or climate emergencies, Streeting warns Published 3 hours ago (https://www.bbc.co.uk/news/articles/c9j34zgmkxx1o) Race to update services' computer systems after cyber-security flaw found Published 8 hours ago (https://www.bbc.co.uk/news/articles/cq74pjpmx0e8o) Trump says Musk has restored access to Ukraine's Starlink network Published 3 hours ago More to explore (https://www.bbc.co.uk/news/articles/cm369kkg92x6o) Call of Duty promises a return to form - but can it compete with GTA? (A character from Call of Duty Modern Warfare 4. The soldier has short dark hair and a beard with scars above his left eye. He has a serious expression as snow falls behind him in a darkened backdrop.) (https://www.bbc.co.uk/news/articles/c6vgjk1lp7njo) Attack on actor Tiger Shroff is dark reminder of Bollywood's gangster past (Tiger Shroff poses at a promotional event, wearing dark sunglasses and a navy polo shirt with a white collar. The actor leans on a display stand in front of a backdrop featuring large portrait images and text from a film campaign.) (https://www.bbc.co.uk/news/articles/cwly393mj7y3o) The Papers: 'Prepare for the worst' and 'Covid report fallout' (A composite of the front pages of the Metro and the Daily Mirror on 23 October 2026.) (https://www.bbc.co.uk/news/articles/c63r5xpezz51o) 'I'm 96 and have 15 million followers': The grannies taking over TikTok (Ninety-six-year-old Grandma Droniak, holding a martini glass and wearing a pink sparkly top and a white fur shawl. She is standing in front of a dressing table with lights around the mirror.) (https://www.bbc.co.uk/news/articles/cj75p1xr7p7vo) Surveillance and 'constant paranoia': Western diplomats tell BBC of life in war-time Moscow (Vladimir Putin, former US Ambassador to Russia Lynne Tracy, and former French Ambassador to Russia Pierre Levy in front of the Kremlin's Spasskaya Tower.) (https://www.bbc.co.uk/news/articles/cm5yez87qwvdo) I thought I was dying but it was health anxiety - here's how to recognise the signs (A woman with long blonde hair, she is wearing a beige cardigan, black top and a gold necklace. The background is trees and an apartment complex.) (https://www.bbc.co.uk/news/articles/cr5ynl63v0pyo) Newborn twins fight for survival as conflict fuels Yemen's hunger crisis (Malnourished twin Raad Hassan is held by his mother Lina while his sister Raghad lies beside him on a bed at a hospital in Aden, Yemen) (https://www.bbc.co.uk/news/articles/cqlye4v721nwo) Diabetes and ADHD drugs to be tested on Alzheimer's patients in new study (Steve and Angela Bucksey sit side-by-side smiling - Steve has grey hair and is wearing a light blue shirt with a collar, and Angela has shoulder-length greyish hair and wears a green round-necked T-shirt and a necklace) (https://www.bbc.co.uk/newsletters/zgmn46f) US Politics Unspun: Cut through the noise with Anthony Zurcher's newsletter (A cut of of Anthony Zurcher wearing a suit and tie in front of a red, black, grey and blue graphic background featuring the US Capitol Building) Elsewhere on the BBC (https://www.bbc.co.uk/iplayer/episode/m002stm7?at_mid=AGN4uoj05A&at_campaign=The_Reluctant_Vampire&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=iplayer&at_brand=m002stm3&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=The_Reluctant_Vampire&at_bbc_team=BBC) Trending now: The Reluctant Vampire (The Reluctant Vampire) (https://www.bbc.co.uk/sounds/play/p0phg39g?at_mid=lmXZflLuUx&at_campaign=The_Martin_Lewis_Podcast_Question_Time_19th_Oct&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=sounds&at_brand=p02pc9xt&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=consumption&at_link_title=The_Martin_Lewis_Podcast_Question_Time_19th_Oct&at_bbc_team=BBC) Premium Bonds, pensions and credit applications () (https://www.bbc.co.uk/iplayer/episode/p0c991f9?at_mid=Gp0EOzPiEZ&at_campaign=Ellie_and_Natasia&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=iplayer&at_brand=p0c99012&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=awareness&at_link_title=Ellie_and_Natasia&at_bbc_team=BBC) New surreal sketches from icons Ellie White and Natasia Demetriou (Ellie & Natasia) (https://www.bbc.co.uk/sounds/play/m0033tzp?at_mid=m1OuGGO3ik&at_campaign=Tell_Me_Im_Wrong_21_Oct&at_medium=display_ad&at_campaign_type=owned&at_nation=NET&at_audience_id=SS&at_product=sounds&at_brand=m0033j07&at_ptr_name=bbc&at_ptr_type=media&at_format=image&at_objective=awareness&at_link_title=Tell_Me_Im_Wrong_21_Oct&at_bbc_team=BBC) Are UK girl groups the best in the world? (Tell Me I'm Wrong) Most read 1 (https://www.bbc.co.uk/news/articles/c30rlpkglkwpo) Gasps as Prince William makes surprise appearance on Graham Norton Show 2 (https://www.bbc.co.uk/news/articles/cwly393mj7y3o) 'Prepare for the worst' and 'Covid report fallout' 3 (https://www.bbc.co.uk/news/articles/cwd094x57p32o) Prepare for supply chain disruption from cyber or climate emergencies, Streeting warns 4 (https://www.bbc.co.uk/news/articles/cq74pjpmx0e8o) Trump says Musk has restored access to Ukraine's Starlink network 5 (https://www.bbc.co.uk/news/articles/cmy0ryjx7741o) Trump ordered to answer questions under oath in BBC lawsuit 6 (https://www.bbc.co.uk/weather/articles/cq8ezy256e42o) Amber warning in place as Storm Austen hits parts of UK 7 (https://www.bbc.co.uk/news/articles/cmqxn3133rdwo) Celebrity Traitors - paranoia deepens as traitor behaviour splits opinion 8 (https://www.bbc.co.uk/news/articles/cmy56q2n1veqo) Grid operator says lights will stay on this winter after concerns 9 (https://www.bbc.co.uk/news/articles/cw073mj02v72o) Raye wins the Mercury Prize with This Music May Contain Hope 10 (https://www.bbc.co.uk/news/articles/c6m2dwddl3xlo) Items recovered in search for missing fishing boat and crew BBC News Services (https://www.bbc.co.uk/news/10628994) On your mobile (https://www.bbc.co.uk/news/help-50068132) On smart speakers (https://www.bbc.co.uk/news/10628323) Get news alerts (https://www.bbc.co.uk/news/20039682) Contact BBC News (https://www.bbc.com) Home (https://www.bbc.com/news) News (https://www.bbc.com/sport) Sport (https://www.bbc.com/future/earth) Earth (https://www.bbc.com/reel) Reel (https://www.bbc.com/worklife) Worklife (https://www.bbc.com/travel) Travel (https://www.bbc.com/culture) Culture (https://www.bbc.com/future) Future (https://www.bbc.com/culture/music) Music (https://www.bbc.co.uk/schedules/p00fzl9m) TV (https://www.bbc.com/weather) Weather (https://www.bbc.co.uk/sounds) Sounds (https://www.bbc.co.uk/usingthebbc/terms) Terms of Use (https://www.bbc.co.uk/aboutthebbc) About the BBC (https://www.bbc.com/usingthebbc/privacy) Privacy Policy (https://www.bbc.com/usingthebbc/cookies) Cookies (https://www.bbc.co.uk/accessibility) Accessibility Help (https://www.bbc.co.uk/iplayer/guidance) Parental Guidance (https://www.bbc.co.uk/contact) Contact the BBC (https://www.bbc.co.uk/careers) Careers (https://www.bbc.co.uk/bbcnewsletter) BBC emails for you (https://www.bbc.com/advertisingcontact/) Advertise with us Copyright © 2026 BBC. The BBC is not responsible for the content of external sites. (https://www.bbc.co.uk/editorialguidelines/guidance/links-and-feeds) Read about our approach to external linking. ()