The vulnerability in the programming language, which became public on Tuesday, sparked warnings from national security agencies in Washington and London. It means millions of websites will need to be fixed. One internet infrastructure expert said Russian state actors or organised criminals could exploit the flaw to carry out cyber-attacks.<\/p>\n
WordPress, one of the most common website systems, uses PHP, as does Wikipedia, the messaging software Slack and \u2013 at least historically \u2013 much of Facebook. The Wikimedia Foundation said it had taken down several systems on Wednesday as a precautionary measure until they could be patched.<\/p>\n
The organisation behind the language issued a patch on Wednesday after researchers testing cyberdefences discovered the flaw. The US National Security Agency told all organisations using PHP to take their systems offline if they were unable to patch them immediately. It said the vulnerability could \u201cprovide a direct path to the server\u2019s file system or database\u201d.<\/p>\n
The UK\u2019s National Cyber Security Centre gave similar advice and told organisations to check for \u201cbackdoors installed by an attacker\u201d.<\/p>\n
Prof Alan Woodward, a cybersecurity expert at Surrey University, said: \u201cIt was very surprising and troubling because of the extent to which PHP was used around the world. PHP issued a patch very quickly. The big thing is for everyone using it to get that in to make sure their systems are safe.<\/p>\n
\u201cThe troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks. For the big juicy targets, I hope to goodness they are being patched quickly.\u201d<\/p>\n
skip past newsletter promotion<\/a><\/p>\n Sign up to TechScape<\/p>\n A weekly dive in to how technology is shaping our lives<\/p>\n after newsletter promotion<\/p>\n Woodward said there was a window of opportunity for bad actors. \u201cThere is this race and some people unfortunately don\u2019t even know they are in the race.\u201d<\/p>\n OpenAI said<\/a> it led a coalition of researchers that discovered the flaw and claimed \u201cfrontier AI\u201d had been key. The researcher who found the weakness, however, said<\/a> they did not use models that were not available to the general public.<\/p>\n In the UK, websites belonging to Edinburgh, Bristol and Oxford councils were taken offline. In France, local government websites including that of the Paris police prefecture went offline on Wednesday, as did in the Netherlands the national digital identity service, the website of the house of representatives and the site of the national cybersecurity centre.<\/p>\n The Australian Signals Directorate was temporarily affected by the outage overnight local time, with the national cyber defence agency noting other government websites may have been similarly affected.<\/p>\n Micha\u0142 Wo\u017aniak, an internet infrastructure expert, said: \u201cThere\u2019s going to be a lot of automatic exploitation of this.\u201d The bug might allow cryptocurrency miners to exploit vulnerable servers at other people\u2019s expense, he said.<\/p>\n He also said large crime organisations and Russian state actors could use the vulnerable sites as a launching pad from which to conduct distributed denial of service (DDoS) and other cyber-attacks.<\/p>\n The issue highlighted the poor state of internet infrastructure, Wo\u017aniak said, something that was being brought to light by advancing AI models but that had been a long-developing problem. The underlying vulnerabilities the researcher found were decades old.<\/p>\n \u201cThis is an environmental problem in an industry where there\u2019s an incentive to move fast and make changes,\u201d he said. \u201cThere\u2019s an incentive to deploy a thing and then never update it and not think about maintenance.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"Websites around the globe have gone dark after a serious vulnerability was found in a computer language used…\n","protected":false},"author":2,"featured_media":809703,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[49,50,51,47,52,48],"class_list":["post-809702","post","type-post","status-publish","format-standard","has-post-thumbnail","category-headlines","tag-headlines","tag-news","tag-top-news","tag-top-stories","tag-topnews","tag-topstories"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/809702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=809702"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/809702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/809703"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=809702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=809702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=809702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"https:\/\/www.newsbeep.com\/uk\/wp-content\/uploads\/2026\/10\/1792622292_486_500.jpg\")
<\/p>\n