London, United Kingdom, October 22, 2026 — Government agencies and organisations around the world have taken some websites offline or urged operators to do so after two critical security vulnerabilities were discovered in PHP, a programming language widely used to power websites and online services. A security fix was issued on Wednesday.
Finland temporarily shut down its government’s public web services, while the Netherlands’ cybersecurity agency said it was taking its website offline as a precaution. The Wikimedia Foundation also said it had taken several systems offline until they could be safely patched. Parts of Wikipedia became inaccessible, while the websites of Edinburgh City Council and several BBC programmes also became unavailable. However, those organisations had not confirmed that their outages were directly linked to the PHP vulnerabilities.
The flaws were discovered by cybersecurity researchers at Calif and Wiz using advanced artificial intelligence tools. OpenAI described the discovery as one of the most significant security issues in recent memory. Wiz said the vulnerabilities had remained undetected for more than a decade.
Wiz estimated that roughly 70% of the internet could be affected, although the BBC said it could not independently verify that figure.
Cybersecurity agencies in the United Kingdom, European Union, Australia and Japan have urged organisations using PHP to install the available fixes. The UK’s National Cyber Security Centre advised organisations unable to address the vulnerabilities immediately to consider taking affected systems offline until they could be secured.
