Race to Update Systems After PHP Vulnerability Discovered
Source reports published 22 Oct 2026, 10:51 pm – 23 Oct 2026, 10:00 am AEST
Following the discovery of critical vulnerabilities in the PHP programming language, organizations worldwide are rushing to update their systems. Government sites experienced temporary outages as security work was undertaken to mitigate potential risks.
What happened
- Following the identification of ‘critical vulnerabilities’ in PHP, a widely-used programming language, numerous websites and government services experienced disruptions.
- The UK government, led by Baroness Lloyd of Effra, took precautionary measures, temporarily offline some services, citing 32 unavailable and four partially available services.
- Cybersecurity experts, including NCSC chief technology officer Olly Whitehouse, described the event as "unprecedented", noting that impacts may take months to fully materialize.
- The FBI’s cyber division warned of the potential for malicious actors to remotely execute code, prompting immediate action by organizations like Cloudflare, where Matthew Prince reported millions of attempts to exploit the vulnerability.
- Researchers, including OpenAI, utilized AI to identify the flaws, leading to the release of patches.
- Concerns were raised by leaders such as Sam Altman and Marc Benioff about the accelerating pace of vulnerability discovery and exploitation, predicting a "vulnerability tsunami."
- The PHP Foundation released fixes, while the NSA issued an alert recommending immediate implementation of patches.
- Attempts to exploit the vulnerability were observed, with Cloudflare reporting thousands of initial attempts, escalating to millions within hours of the announcement.
Original reporting
- BBC: Race to update services' computer systems after cyber-security flaw found
2026-10-22T17:12:51.604000+00:00 - PBS NewsHour: AI discovered a software vulnerability that could impact 70% of websites worldwide. The rush is on to patch it
2026-10-22T12:51:30+00:00 - Guardian: ‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking
2026-10-23T00:00:00+00:00