Governments and companies around the world spent Thursday racing to patch two critical security flaws in PHP, the programming language that quietly powers most of the web — and in many cases simply switched their websites off until the fix could be applied.
In Britain, technology minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four more partially disrupted. She stressed that the outages were largely the result of precautionary shutdowns while security updates were applied, and that officials were not aware of any confirmed compromise of central government systems. Among the bodies known to have taken their sites offline is the Office for Budget Responsibility, the Treasury watchdog — an awkward absence with the Budget due next week. Local councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet were also affected, along with some BBC web portals.
The flaws, grouped under the name PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, are “remote code execution” bugs: they can allow an attacker with no login credentials to run their own code on a vulnerable server. That is about as serious as web vulnerabilities get. PHP underpins roughly three quarters of websites whose technology can be identified, including WordPress, which runs more than 40% of all sites. Security experts have rated the flaws as high as 9.2 out of 10 in severity, and a former head of the UK’s National Cyber Security Centre, Ciaran Martin, described the discovery as the most serious vulnerability detected in five years.
Britain was far from alone. Germany’s federal IT provider took government websites offline as a preventive measure, France suspended the sites of its local prefectures, Belgium’s foreign ministry pulled its websites down, and in the Netherlands the Port of Rotterdam, the national football association and numerous hospital sites went dark. Finland’s state IT centre shut the government’s public web services, the Czech government took its website offline on its cyber watchdog’s advice, and in Japan the finance ministry, tax agency, brokerage Nomura, lender MUFG and airline ANA all suspended some online services. In the United States, the National Security Agency urged organisations to patch or disconnect vulnerable systems.
The episode has an unusual twist: the bugs were found with the help of artificial intelligence. A researcher at security firm Calif discovered one of them using an OpenAI model, while researchers at Wiz separately uncovered both flaws using AI tools. OpenAI then helped coordinate disclosure with vendors and governments, and the UK’s NCSC was briefed in advance and sent out 50,000 warnings to businesses and other organisations. The planned patch release was brought forward to Wednesday after details leaked — and within hours of the flaws becoming public, Cloudflare recorded exploitation attempts jumping from thousands to millions.
Patches are now available, and the NCSC’s advice is blunt: update immediately, or consider taking a vulnerable system offline until it can be fixed. For smaller organisations running old, unsupported versions of PHP, that may mean rebuilding entire systems — a reminder of how much of the modern internet still rests on decades-old code that few people ever see.
Sources:
The Register — https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840
The National — https://www.thenationalnews.com/news/europe/2026/10/22/uk-orders-dozens-of-official-websites-offline-after-flaw-warnings/
Leave a Reply