World Leaders Warn of Security Flaws Found in PHP Programming Language

Source reports published 21 Oct 2026, 10:00 am – 22 Oct 2026, 1:48 pm AEST

A vulnerability in the PHP computer language led to the shutdown of numerous websites globally. Developers quickly released patches, urging users to update their systems to prevent potential cyberattacks.

What happened

• Following the discovery of vulnerabilities in the PHP programming language, a critical weakness affecting approximately 70% of websites worldwide, governments and cybersecurity agencies initiated precautionary measures.
• The US National Security Agency advised organizations using PHP to take their systems offline if immediate patching was not feasible, citing a potential "direct path" to server file systems or databases.
• The UK’s National Cyber Security Centre issued similar guidance, urging checks for "backdoors".
• OpenAI, in collaboration with researchers, identified the flaws using AI, describing them as "one of the most impactful security issues in recent memory".
• The Wikimedia Foundation took down systems as a precautionary measure, while the PHP Foundation released a patch.
• Authorities in France, Germany, Belgium, the Netherlands, Finland, and the Czech Republic temporarily disabled government websites to mitigate potential attacks.
• Dane Knecht, CTO of Cloudflare, reported "early attacks" emerging, prompting ongoing mitigation efforts.
• The vulnerabilities, dubbed PHP2Shell, had been present for years but were difficult to detect without AI assistance.
• The situation highlighted the ongoing need for vigilance against cyber threats and the importance of rapid patching in the digital landscape.

Original reporting

• Guardian: Flaw in PHP computer language leads to shutdown of websites around world
  2026-10-21T00:00:00+00:00
• Deutsche Welle: PHP developers say key patches available after global scare
  2026-10-21T16:56:07.197000+00:00
• BBC: PHP: What is it and why did it spark a global cyber security scramble?
  2026-10-22T03:48:50.518000+00:00
• Al Jazeera: World leaders warn of security flaws found in PHP programming language
  2026-10-22T00:00:00+00:00