Critical PHP Flaws Put Millions of Websites at Risk

WHO:

The Guardian - UK technology minister Liz Lloyd reported that 32 government services were unavailable and four were partially unavailable.

The Guardian - A No 10 spokesperson said the National Cyber Security Centre was working with OpenAI and international partners on potential PHP-related problems.

Global News - AI Minister Evan Solomon said the Canadian government was taking some of its websites offline on the advice of the Communications Security Establishment’s cyber security centre.

Global News - Jason Gallaugher, chief technology and security officer at the Canadian Internet Registration Authority, said most Canadian internet users who do not operate a website may not need additional security measures.

Inc - The PHP Security Team released updates for website owners.

Wired - The PHP Foundation disclosed two serious vulnerabilities.

Wired - Security experts warned about the consequences of failing to patch the flaws promptly.

WHAT:

The Guardian - The UK government took 32 services offline and made four partially unavailable while applying security updates and mitigations.

The Guardian - Downing Street said no large UK public-facing critical services had been affected; some limited government websites had gone offline.

Cointelegraph - A PHP security fix was delayed because of what the PHP Foundation described as a “structural failure.”

Cointelegraph - Cloudflare CEO Matthew Prince said the network saw thousands of exploit attempts before the PHP vulnerability was publicly disclosed.

Wired - Amazon Web Services logged attempts to exploit the PHP2Shell vulnerabilities four days before the fixes were released.

Wired - The PHP2Shell vulnerabilities are now being “broadly exploited” across the internet.

BBC - OpenAI called the discovery “one of the most impactful security issues in recent memory” and said an internal researcher had discovered the issue around the same time as researchers at other firms.

Global News - Cloudflare’s chief technology officer said evidence of early attacks had emerged.

Global News - The Canadian government said affected websites would be restored once patches were applied.

Global News - The Canadian Centre for Cyber Security advised organizations to identify third-party products using PHP and update them.

Global News - The vulnerabilities could enable attackers to steal information or deface websites.

[13 articles] - ABC News - Experts said the code vulnerability could allow attackers to take over servers.

[13 articles] - CNET - Up to 70% of websites on the internet could be affected.

[13 articles] - Reuters - Government, school, and hospital websites in Europe were taken offline as organizations worked to protect against the PHP flaws.

[13 articles] - Engadget - Government websites in the EU and Canada were taken offline over the PHP vulnerability.

ABC News - Experts say the PHP vulnerability could allow attackers to take over servers.

CNET - Up to 70% of all websites on the internet could be affected by the PHP vulnerabilities.

Reuters - Several government, school, and hospital websites in Europe were taken offline as organizations worked to protect themselves from the PHP security flaws.

Inc - Two critical vulnerabilities could affect millions of websites.

Inc - The PHP Security Team released updates related to the vulnerabilities.

Wired - Two serious PHP vulnerabilities could impact millions of websites.

Wired - Security experts warned that failing to quickly patch the flaws could have “dire consequences.”

Wired - The headline describes the vulnerabilities as “setting the internet on fire” and quotes the warning, “This Is Not a Drill.”

WHERE:

The Guardian - The affected government services were in the UK.

Reuters - Government, school, and hospital websites in Europe were taken offline.

WHY:

The Guardian - Liz Lloyd said the service outages had largely resulted from precautionary measures to protect systems while security updates and mitigations were applied.

Inc - Website owners should know about the updates because of the critical vulnerabilities.

Wired - Prompt patching was urged because failure to address the flaws could have dire consequences.

HOW:

Tech News World - The NSA recommends that organizations using PHP take affected systems offline if an immediate update is not feasible.

Global News - Security companies Calif, working with OpenAI, and Wiz, owned by Google, independently identified vulnerabilities in August using AI models.

[13 articles] - Tech News World - The NSA recommends that organizations using PHP take affected systems offline if an immediate update is not feasible.

Engadget - The discovery of the two severe vulnerabilities left site administrators on edge.

Inc - The PHP Security Team released updates; the article tells website owners to act “right now.”

Wired - Security experts urged quickly patching the flaws.

(UPDATED October 22, 2026 14:01 UTC)

Two serious vulnerabilities in PHP, software used by millions of websites, are now being broadly exploited, with attacks reported before fixes were released. The flaws could let attackers steal information, deface websites or take control of servers, and experts say up to 70 percent of sites may be affected. The PHP Security Team has issued updates, and security officials are urging website owners to patch promptly. The U.S. National Security Agency recommends taking affected systems offline if an immediate update is not possible. In the UK, 32 government services went offline and four were partly unavailable as officials applied protections; Downing Street said no major public-facing critical services were affected. Canadian authorities also took some government websites offline, while government, school and hospital sites in Europe were taken down as a precaution. Canada says affected sites will return after patches are applied.

(UPDATED October 22, 2026 10:10 UTC)

Two serious flaws in PHP, software used to build websites, are being broadly exploited, with experts warning attackers could take over servers, steal information, or deface sites. Cloudflare reported thousands of attempts before the vulnerability was publicly disclosed, while Amazon Web Services logged attacks four days before fixes were released. The PHP Security Team has issued updates, but a delay in one fix was attributed to what the PHP Foundation called a structural failure. The Canadian government and organizations in Europe have taken some government, school, and hospital websites offline while applying patches. Canadian officials say affected sites will return once updated, and urge organizations to check third-party products that use PHP. The NSA advises taking affected systems offline if an immediate update is not possible. Security researchers identified the flaws independently, with AI assistance, and experts say prompt patching is critical.

(UPDATED October 22, 2026 03:08 UTC)

Two serious vulnerabilities in PHP, a programming language used across the web, are now being broadly exploited, with attackers able to steal information, deface websites or take over servers. Amazon Web Services recorded attempts to exploit the flaws four days before fixes were released by the PHP Security Team. Experts say the vulnerabilities could affect millions of websites, with estimates reaching up to 70 percent of sites online. Governments and other organizations are taking systems offline while they apply patches, including Canadian government websites and sites run by European governments, schools and hospitals. Canada’s cybersecurity agency is urging organizations to identify third-party products that use PHP and update them. The NSA recommends taking affected systems offline if an immediate update is not possible. Canadian officials say their websites will return once patched, while security experts warn that delaying updates could have serious consequences.

(UPDATED October 22, 2026 02:09 UTC)

Two critical vulnerabilities in PHP, the software used by many websites, could let attackers steal information, deface sites, or take over servers. Experts say as many as 70 percent of websites could be affected, and evidence of early attacks has emerged. OpenAI called the discovery one of the most impactful security issues in recent memory; security firms identified the flaws independently in August using AI models. The PHP Security Team has released updates, and experts are urging website owners to install them promptly. Canada has taken some government websites offline while patches are applied, and government, school, and hospital sites in Europe have also been taken offline as organizations work to protect them. Canadian officials advise organizations to identify third-party products running PHP and update them. The NSA recommends taking affected systems offline if an immediate update is not possible.

(UPDATED October 22, 2026 01:20 UTC)

Two serious vulnerabilities in PHP, the software used by millions of websites, could let attackers take control of servers. Security experts say as many as 70 percent of websites worldwide could be affected, and warned that failing to act quickly could have dire consequences. The PHP Security Team has released updates, and website owners are urged to install them promptly. As organizations assess their exposure, some government, school, and hospital websites in Europe have been taken offline as a precaution. Government sites in Canada have also been taken offline over the vulnerability. The NSA recommends that organizations take affected systems offline if they cannot install an update immediately. The flaws have left site administrators on edge, with experts emphasizing that protecting exposed systems should be an urgent priority.

(UPDATED October 21, 2026 18:09 UTC)

The PHP Security Team has released updates for two serious vulnerabilities that could put millions of websites at risk. Experts say attackers may be able to exploit the flaws to take control of servers, and warn that failing to patch promptly could have dire consequences. The vulnerabilities may affect as many as 70 percent of websites on the internet. In Europe, some government, school, and hospital websites were taken offline as organizations worked to protect their systems. The discovery has left site administrators on edge, with security experts urging them to install the updates quickly. The PHP Security Team’s fixes are intended to address both flaws, and website owners are being told to act now. The potential reach is broad, making prompt attention important for organizations that rely on PHP-powered sites.

(UPDATED October 21, 2026 17:16 UTC)

Two serious vulnerabilities in PHP, a widely used technology behind websites, could affect millions of sites and potentially as much as 70 percent of the internet. The PHP Security Team has released updates, and website owners are being urged to install them promptly. Security experts warn that failing to patch the flaws could have dire consequences. The risk has already led some organizations to take action: government, school, and hospital websites in Europe were taken offline as their operators worked to protect them. The vulnerabilities are considered critical, and the scale of PHP’s use means the potential exposure is broad. Administrators should apply the security updates as quickly as possible to reduce the chance of attacks exploiting the flaws.

(UPDATED October 21, 2026 16:20 UTC)

The PHP Security Team has released updates addressing two critical vulnerabilities that could affect millions of websites. The PHP Foundation disclosed the serious flaws, and security experts are urging website owners to install the fixes promptly. They warn that failing to patch quickly could have dire consequences. The updates are intended for website owners whose sites may be exposed to the vulnerabilities. Experts say action is needed now, rather than waiting to address the problem later. The flaws have been described in urgent terms, with a warning that this is not a drill. Website owners should check for the relevant PHP updates and apply them as soon as possible to protect their sites.