PHP security crisis live — all the latest news as issues affect websites across the world

Websites across the globe are scrambling to ensure they are protected against possible cyberattacks this morning.

<![CDATA[ <article> <div class="live-content"><p>Websites across the globe are scrambling to ensure they are protected against possible cyberattacks this morning.</p><p>A potentially critical security flaw in the PHP programming language has meant organizations around the world need to update their systems immediately, with hackers ready to strike.</p><p>PHP has issued a series of patches which it says mitigates the issue, but users are reporting issues with some websites across the globe - we're tracking the story as it develops, and you can follow our updates here.</p><iframe data-lazy-priority="low" data-lazy-src=""></iframe><div style="min-height: 250px;"> <div class="kwizly-quiz kwizly-XpB2vW"></div> </div> <script src="https://kwizly.com/embed/XpB2vW.js" async></script></div><div class="live-content"><time datetime="2026-10-22T09:06:57+00:00">October 22, 2026 – 5:06 AM</time><p>News of the issue first broke yesterday, when <a href="https://www.techradar.com/pro/security/website-admins-across-the-world-bracing-for-impact-following-major-php-flaw-reveal" target="_blank">PHP notified the security world of two critical vulnerabilites detected in its systems</a>.</p><p>The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.</p><p>PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."</p></div><div class="live-content"><time datetime="2026-10-22T09:10:45+00:00">October 22, 2026 – 5:10 AM</time><h2 id="what-is-php">What is PHP?</h2><p>PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.</p><p>In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.</p><p>PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.</p></div><div class="live-content"><time datetime="2026-10-22T09:14:38+00:00">October 22, 2026 – 5:14 AM</time><h2 id="what-has-actually-happened">What has actually happened?</h2><p>It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.</p><p>Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources.</p><p>So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.</p><p>Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now.</p></div><div class="live-content"><time datetime="2026-10-22T09:31:21+00:00">October 22, 2026 – 5:31 AM</time><h2 id="wondering-how-this-affects-you">Wondering how this affects you? </h2><p>While most websites are back up and running, there were some that were taken offline yesterday after the news broke. Did you notice anything amiss? Tell us in the comments above, or vote in the poll to let us know what you normally do when you hear about cybersecurity issues in the news. </p><div style="min-height: 250px;"> <div class="kwizly-quiz kwizly-eJ9a9X"></div> </div> <script src="https://kwizly.com/embed/eJ9a9X.js" async></script></div><div class="live-content"><time datetime="2026-10-22T09:38:49+00:00">October 22, 2026 – 5:38 AM</time><h2 id="php-fixes-are-out-now-so-get-patching">PHP fixes are out now - so get patching</h2><p>As we've covered on TechRadar Pro this morning, PHP has now <a href="https://www.techradar.com/pro/security/php-releases-emergency-fixes-as-some-of-the-worlds-biggest-websites-say-they-were-targeted-by-hackers" target="_blank">released its emergency fixes for users to download</a>.</p><p>The issues are listed as CVE-2026-109618 and CVE-2026-109619 - the former is an out-of-memory handling bug, while the latter is a use-after-free memory error. Both were assigned a severity score of 9.2/10 (critical).</p><p>The vulnerabilities were addressed in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Users can download the versions from PHP’s downloads pages, with Windows source and binaries being on the same page.</p></div><div class="live-content"><time datetime="2026-10-22T09:49:40+00:00">October 22, 2026 – 5:49 AM</time><h2 id="open-source-worries">Open source worries</h2><figure class="van-image-figure inline-layout" data-bordeaux-image-check ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:970px;"><p class="vanilla-image-block" style="padding-top:56.19%;"><img id="hsp2hXrMRpqTNDhd2ZFJof" name="open-source.jpg" alt="open source software" src="https://cdn.mos.cms.futurecdn.net/hsp2hXrMRpqTNDhd2ZFJof-1920-80.jpg" mos="" align="middle" fullscreen="" width="970" height="545" attribution="" endorsement="" class="inline"></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Pixabay)</span></figcaption></figure><p>The issue may raise wider concerns about the role of open source software in propping up some of the most integral parts of the global information network - as the very thing that makes it so unique also leaves it vulnerable to flaws and security concerns.</p><p>"Much of the critical software running the world is also the least visible. Stable production code 'that just works' is now at risk due to the speed and volume of new vulnerabilities found via AI-driven discovery," says Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.</p><p>"The issues facing PHP are a reminder of just how deeply open source is woven into the systems that run global business."</p><p>"The ripple effects from vulnerabilities in foundational software like PHP can extend across entire industries. This makes it critical to have a trusted software source that helps manage this risk and, ideally, quickly responds to these new threats as they emerge."</p></div><div class="live-content"><time datetime="2026-10-22T10:00:49+00:00">October 22, 2026 – 6:00 AM</time><h2 id="quot-a-finite-window-quot-to-patch-and-protect">"A finite window" to patch and protect</h2><p>This is clearly an alarming issue, one which will likely affect companies of all sizes across the globe, so how quickly should businesses look to respond?<em> </em></p><p>"This is a stake-in-the-ground moment for CISOs around the world," says Matt Cooke, EMEA Cybersecurity Strategist at Proofpoint.</p><p>"Organisations of every size have a finite window to shore up their cyber defences, because threats now operate at machine speed. Patch fast, know your attack surface and limit the blast radius, because that window is closing. If we don't act now, we will see more organisations forced to take their sites offline while they scramble to fix what should have been secured long ago."</p></div><div class="live-content"><time datetime="2026-10-22T10:12:32+00:00">October 22, 2026 – 6:12 AM</time><h2 id="who-has-been-affected-so-far">Who has been affected so far?</h2><figure class="van-image-figure inline-layout" data-bordeaux-image-check ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:900px;"><p class="vanilla-image-block" style="padding-top:56.22%;"><img id="QpRErZT4bqxtsTLW3jmxmC" name="Cybercrime_silhouette_yahoo.jpg" alt="Cybercrime" src="https://cdn.mos.cms.futurecdn.net/a50bdbac073879033be2b256b6dc058d-1920-80.jpg" mos="" align="middle" fullscreen="" width="900" height="506" attribution="" endorsement="" class="inline"></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Future)</span></figcaption></figure><p>With an issue as widespread as this (some reports are claiming around 70% of the web as we know it could be affected) it's tricky to list all the affected sites and businesses - mainly because many won't want to admit to any security shortcomings.</p><p>Thanks to <a href="https://www.reuters.com/technology/websites-taken-offline-over-php-risks-2026-10-21/" target="_blank"><em>Reuters</em></a>, we do know that several European governments have seen some effect, although many of the sites are now back up online, including:</p><p>- The German digital ​ministry said federal IT service provider ITZBund had taken several websites offline due to ​the discovery of PHP vulnerabilities, although this was a "purely preventive" move.</p><p>- The French Interior Ministry temporarily took down the ​websites of local government administrative offices while awaiting the PHP patches - again, this was a preventive measure.</p><p>- Belgium's foreign ministry temporarily took its websites offline following reports of cyberattacks exploiting the PHP vulnerabilities, although this was not confirmed.</p><p>- In the Netherlands, the nation's National Cyber Security Centre ​took its public-facing sites offline, along with those belonging to the Port of Rotterdam, the Dutch national football association KNVB, the ‌websites of ⁠the five largest political parties and numerous hospital websites across the country.</p></div><div class="live-content"><time datetime="2026-10-22T10:22:17+00:00">October 22, 2026 – 6:22 AM</time><h2 id="what-role-did-ai-and-openai-play">What role did AI - and OpenAI - play?</h2><figure class="van-image-figure inline-layout" data-bordeaux-image-check ><div class='image-full-width-wrapper'><div class='image-widthsetter' style="max-width:1920px;"><p class="vanilla-image-block" style="padding-top:56.98%;"><img id="2KzVq8gkFv5n7v3rCCqCoe" name="openai header" alt="OpenAI logo on a smartphone screen" src="https://cdn.mos.cms.futurecdn.net/2KzVq8gkFv5n7v3rCCqCoe-1920-80.jpg" mos="" align="middle" fullscreen="" width="1920" height="1094" attribution="" endorsement="" class="inline"></p></div></div><figcaption itemprop="caption description" class=" inline-layout"><span class="credit" itemprop="copyrightHolder">(Image credit: Shutterstock / Mehaniq)</span></figcaption></figure><p>An interesting note about the PHP flaws is that they were detected (at least partly) by AI.</p><p>Ryan Austin, the researcher at cybersecurity firm Calif who played a major role in uncovering the PHP flaw, has acknowledged the part OpenAI's systems played in revealing the issues.</p><p>Potential PHP flaws had first been spotted back in 2024 by its own researchers, but it had to wait until July 2026 before being accepted into <a href="https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/" target="_blank" rel="nofollow">OpenAI’s Patch the Planet initiative</a>, which looks to use advanced AI systems to detect and solve cybersecurity issues.</p><p>Calif, which was part of Patch the Planet, then found a more serious issue in PHP in August 2026, which was spotted by OpenAI's own systems shortly after, before the group began working on a fix.</p><p>"Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications," OpenAI's blog post noted.</p><p>"Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory. It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."</p></div> </article> ]]>