Major websites go offline worldwide after critical PHP flaws found
Major websites and government services across the world have gone offline after researchers discovered two critical security vulnerabilities in PHP, a programming language used by much of the internet.
The flaws prompted governments and cybersecurity agencies to warn website operators to install emergency updates or temporarily shut down affected services, according to BBC News.
Among the affected organisations were the BBC, Wikipedia, the Internet Archive, Finland’s government and Edinburgh City Council. Some websites were deliberately taken offline as a precaution rather than because of a confirmed cyberattack.
Other reported disruptions affected 4chan, DeviantArt and government services in several European countries, including France, Germany, Belgium and the Netherlands.
In Britain, websites associated with the Metropolitan Police, local councils and BBC programmes such as Doctor Who and The Traitors also experienced access problems.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received severity ratings of 9.2 out of 10.
Security researchers warned that attackers could exploit the flaws to execute malicious code on vulnerable servers without needing login credentials, potentially gaining access to sensitive information.
Why are so many websites affected?
PHP is a widely used programming language that handles essential website functions, including user authentication, database access and content management.
It powers much of the technology behind platforms such as WordPress, Drupal and Joomla. Approximately 70% of websites with an identifiable server-side programming language use PHP.
The vulnerabilities were discovered with assistance from artificial intelligence tools, with cybersecurity company Wiz describing them as among the most serious security flaws identified using the technology.
The PHP development team released emergency security updates on October 21, including versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The UK’s National Cyber Security Centre urged organisations to install the patches immediately and consider taking vulnerable systems offline if they could not apply the updates.
Cloudflare also reported detecting early attempts to exploit the vulnerabilities, raising concerns that attackers could target systems that remain unpatched.
Although fixes are now available, the timing of individual website restorations depends on how quickly operators can secure their systems. Some services have already begun returning online, while others may remain temporarily unavailable.
The incident follows a separate Google Cloud outage on October 20 that disrupted major services including Revolut, HSBC, Lloyds Bank and Royal Mail. The two incidents had different causes, with the earlier disruption linked to a power problem at Google’s London data centre.
For ordinary internet users, the PHP vulnerabilities do not require updating their browsers or phones. The responsibility for securing affected systems lies with website operators and hosting providers.
