---
title: "Global websites offline as critical PHP security flaws trigger emergency response"
publisher: "Stockmark.IT"
author: "Stockmark.IT Website"
published: "2026-10-22T05:34:49+00:00"
modified: "2026-10-22T05:34:49+00:00"
date: 2026-10-22
canonical: "https://stockmark.it/websites-taken-down-worldwide-as-critical-cyber-security-update-issued/"
category: "Cyber Security"
categories: ["Cyber Security", "Government"]
image: "https://i0.wp.com/stockmark.it/wp-content/uploads/2026/10/global-websites-offline-as-critical-php-security-flaws.png?fit=1536%2C1024&quality=80&ssl=1"
format: "news"
language: "en-GB"
---

# Global websites offline as critical PHP security flaws trigger emergency response

**Published:** October 22, 2026
**Author:** Stockmark.IT Website
**Categories:** Cyber Security, Government
**Featured image:** ![Global websites offline as critical PHP security flaws trigger emergency response](https://i0.wp.com/stockmark.it/wp-content/uploads/2026/10/global-websites-offline-as-critical-php-security-flaws.png?fit=1536%2C1024&quality=80&ssl=1)

---

International governments and cyber-security agencies have issued urgent warnings to organisations worldwide following the discovery of two critical vulnerabilities in the PHP programming language. The flaws, which affect a significant portion of the internet, have prompted entities including the Finnish government, the Dutch parliament, and various UK public bodies to take their websites offline as a precautionary measure. A fix was released on Wednesday afternoon, but officials have advised that any system unable to be patched immediately should be disconnected from the internet to prevent potential exploitation.

The vulnerabilities were identified by researchers at cyber-security firms Calif and Wiz, with the assistance of advanced artificial intelligence tools. Wiz described the findings as the most severe vulnerabilities ever discovered by such technology. The flaws had remained undetected for more than a decade before being uncovered in August after researchers used frontier AI models to develop and adapt working exploits across multiple applications. OpenAI, whose advanced tools were used in the discovery through a programme called Patch the Planet, stated that the issue was one of the most impactful security problems in recent memory. An internal researcher at OpenAI also independently discovered the issue around the same time.

The scale of the potential impact has been described as vast. Wiz estimated that roughly 70 per cent of the internet is affected, although this figure has not been independently verified. The European Union Computer Emergency Response Team noted that the risk scores indicate the potential for unauthenticated remote code execution. This type of vulnerability could allow attackers to install malware, access server file systems or databases, and take down websites. Cyber-security expert Don Smith from the Sophos Counter Threat Unit warned that the immediate challenge for organisations is not merely installing a patch, but identifying and managing every instance where PHP is running, as the language often sits beneath public websites and third-party products without being obvious to the user.

The urgency of the situation was heightened when details of the flaw were leaked on social media on Tuesday. This forced the PHP Foundation to rush its announcement of the vulnerability and the subsequent release of the fix, which was originally scheduled for later in the month. The US National Security Agency advised organisations to take systems offline if they could not update promptly, noting that the vulnerabilities often provide a direct path to sensitive data. The White House confirmed that federal agencies were collaborating with leading AI labs to accelerate the remediation process.

In the United Kingdom, the National Cyber Security Centre urged users of PHP to apply the fixes immediately. It stated that where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. Similar warnings were issued by cyber-security counterparts in the European Union and Australia. In Japan, Prime Minister Sanae Takaichi urged the public to check whether their publicly available websites run on PHP. The Wikimedia Foundation, which operates Wikipedia, confirmed it was addressing the vulnerabilities and had taken down several systems as a precaution, resulting in some users being unable to access parts of the site on Wednesday.

The PHP Foundation has issued updates only for the latest versions of the language. Users of PHP 8.1 or older versions are urged to upgrade. It is not yet clear exactly which versions are affected, but CERT-EU indicated that the issue could affect all versions dating back to PHP 5, which was launched in 2004. Dane Knecht, chief technology officer at Cloudflare, reported seeing early attacks emerging and stated that mitigations are being updated as new vectors appear. The NCSC advised that once updates are installed, organisations should continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP.

---

**Original URL:** https://stockmark.it/websites-taken-down-worldwide-as-critical-cyber-security-update-issued/
*Created by [WP Markdown Endpoint](https://wpmarkdownendpoint.com/)*