Rory Hopcraft, a cyber-security lecturer at the University of Plymouth, says the patch was available yesterday evening UK time, meaning we're already seeing services returning.

When asked about the role of AI, he says "it's a positive thing that we're seeing these tools used for good, it can help us understand the vulnerabilities".

Joe Tidy compares the PHP flaw with a previous cyber-security issue in 2021, when it took 15 days for cyber criminals to begin carrying out malicious intent, he says.

"Now we have AI, the criminals have taken half a day to come up with something usable," Tidy says.

Cyber correspondent Joe Tidy says he didn't know PHP existed until yesterday morning - it's "one of these things we take for granted", he says.

But those in the cybercrime world will "jump on a vulnerability like this because it could open up a huge number of possibilities", he says.

Explaining how cyber criminals could exploit the flaw, Tidy says: "If you are able to plant your code on someone else's servers, you can do whatever you want.

"So you can deface a website, bring it down, plant malicious software, extract data."

That is "pretty much a worst-case scenario situation for a lot of organisations out there", he explains.

This creates a race against time, with organisations who are unable to patch their sites quickly then needing to take them offline while they figure out what to do, Tidy adds.

PHP is "part of the invisible infrastructure [of the internet] that we all take for granted", says BBC cyber correspondent Joe Tidy, who notes that it potentially runs up to 70% of websites.

Tidy notes that this problem dates back to 2024, when researchers of PHP had a "potential worry about a theoretical flaw but... couldn't work out how it was possible to actually conduct an attack ".

Then artificial intelligence (AI) came along, Tidy explains, as well as an OpenAI project which uses AI to find vulnerabilities and fix them.

Researchers found "two brand new very serious flaws" with PHP and came up with a plan to fix them, he says.

"It was all going to be very civilised" but then someone leaked the details of this flaw, which has "started a frenzy in the cybercrime world" as people on the internet try to exploit the flaw, says Tidy.

How could PHP flaws affect me? What even is PHP?

The BBC has gathered experts who will be answering your questions about the scramble to fix critical security issues identified in the programming language that underpins much of the internet.

Joining us from 10:30 BST will be cyber correspondent Joe Tidy and cyber-security lecturer Dr Rory Hopcraft, of the University of Plymouth.

We'll bring you all the key lines here and you can watch live at the top of the page.

Liv McMahon
Technology reporter

We’ve seen a lot of sites go offline as a precaution or to patch the PHP vulnerabilities flagged yesterday.

At the moment, we do not know whether any hackers have successfully exploited the flaws which surfaced in the widely used programming language.

Experts warn it could allow attackers to remotely run malicious code on affected web servers or steal data.

But some large organisations have said they’ve seen a high volume of attempts to breach their systems.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X earlier that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he says.

Amazon also says it saw hackers attempt to exploit the flaws, but so far its websites are operating as normal.

No sign of any widespread hacking - yetpublished at 09:54 BST

09:54 BST

Joe Tidy
Cyber correspondent

Internet giants Cloudflare and Amazon are both reporting that millions of hacking attempts are being made by cyber criminals already as the PHP vulnerability is actively being used "in the wild".

These kinds of numbers are alarming but in cyber security there is a big difference between attempts to hack and successful breaches.

It’s important to understand the language that cyber security teams use. A lot of the hacking attempts are likely to be automated scans. Hackers press a few buttons to scan the internet for websites that might be vulnerable.

There are also probably a fair few 'good guys' scanning websites too as part of the emergency response taking place caught up in those figures.

There is no suggestion yet that any major corporations or organisations have been hacked using the PHP flaws.

Even if a website is hacked using PHP, it will likely be a slow and silent process where hackers plant malicious software to compromise patiently.

At the moment there is nothing us consumers can do as the pressure is on companies and institutions to work to protect themselves - and us.

Tom Gerken
Tech reporter

Image source, Reuters

At the moment, most people are going to notice something is amiss when they try and access certain websites.

Bear in mind lots of them are back up already - Wikipedia, for example, is fully operational again, having experienced “emergency maintenance” yesterday.

But the real question is what happens if some websites fail to fix things. At that point, it all becomes a bit unclear. The PHP Foundation calls the flaws "critical vulnerabilities".

There’s no question about how serious they are. Theoretically, a motivated hacker could gain access to the data on a website - which could expose customer details.

At that point, it could suddenly start to have a real impact on people if hackers gain access to their details.

That’s all a bit speculative, of course. But things like this don’t happen unless the threat is serious.

Along with many other affected websites, several BBC webpages are down this morning.

This includes several programme websites on BBC One - including the official site for The Traitors and Eastenders - as well as programme websites across BBC Two and BBC Three.

When you try accessing these websites a message appears on screen saying "this service is temporarily unavailable".

We have asked the BBC Press Office if the PHP flaw is the reason for the webpages not running.

James Delaney
Journalist, BBC Scotland

A number of Scottish councils and health boards took their websites offline on Wednesday after issues were detected.

NHS Scotland was among those to take its sites down for a period while the flaws were rectified, with visitors given a message reassuring them they would be "back soon".

At one point on Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards had taken their websites offline as a precaution.

All council and NHS board websites were back up on Thursday morning, but six councils still said they were experiencing issues with online accounts and payment systems.

Image source, Reuters

The Office for Budget Responsibility (OBR) said yesterday it was one of the organisations that had taken its website offline in light of the PHP flaw.

Sharing the update on X, it said the decision was "consistent with guidance from the National Cyber Security Centre".

The OBR monitors the UK government's spending plans and performance, and releases forecasts for the economy and public finances twice a year. Its next report will be published alongside the government's Budget next week.

A government minister told Times Radio this morning that the security of the Budget had not been compromised by the technical flaw.

Asked whether the PHP issue could result in major Budget leaks, Scotland Secretary Douglas Alexander said: "No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security."

He added that John Healey "initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as chancellor in the summer".

More now from Ryan Austin, the researcher who helped uncover the cyber-security flaw.

He tells Radio 4's Today programme that dealing with the problem in the right way involves "coordinated disclosure".

"We've been working with the PHP Foundation and all of the most popular PHP vendors like WordPress... to inform them a little early as soon as the patches were ready," he says.

It creates "a vulnerability" in a product as soon as something is announced, he says, adding that artificial intelligence means "a lot of bad actors" are now capable of seeking out these vulnerabilities.

Asked whether there is a danger hackers have already exploited the flaw, he says: "Not at the moment... it doesn't look like exploitation has taken off or been widespread."

"This is the most serious vulnerability I've ever found," says Ryan Austin, the researcher at cyber-security firm Calif who helped uncover the PHP flaw.

He tells Radio 4's Today programme that he's been studying PHP security for around 20 years.

You can think of the vulnerability "like a grammatical error in a sentence structure", but "instead of sounding silly, it actually leads to someone breaking into your house," he explains.

Asked what kind of information possible hackers could access, he says: "They would have access to your personal data... anything that you could possibly have stored".

PHP "has been around for a very long time" and is "in a lot of places that you wouldn't expect", he says, adding it is "basically very core to how the internet runs".

Joe Tidy
Cyber correspondent

Image source, Getty Images

In 2024, researchers at the PHP Foundation - a non-profit that maintains and develops popular coding language - found a theoretical flaw in PHP but couldn't figure out how a human hacker could actually use it in an attack.

In July 2026, the PHP Foundation got accepted into OpenAI’s Patch the Planet initiative, which is aimed at using frontier artificial intelligence (AI) to find flaws in popular software and fix them using AI.

In August, a cyber security firm called Calif - which was part of the project - found a serious flaw in PHP, which researchers at OpenAI and Wiz also found shortly after.

Since then, the foundation had been working with the companies on a software patch that could be downloaded by PHP users to fix the flaws, with a plan to release the fix in late October.

But a leak of the basic details was circulated ahead of time on social media, forcing the PHP Foundation to bring forward its announcement.

According to PHP, researchers at Calif then "mistakenly published a video" showing some basic details of how the flaws could be used to hack various websites.

The video was deleted but shared widely in hacking forums, leading to criminals trying to figure out how the hack works. Researchers say the criminals themselves are using AI to 'vibe code' a method of attack.

That’s why the patch has been rushed out and sites have had to be taken down in case attackers use the flaws to carry out cyber attacks.

This should have been a good news storypublished at 08:25 BST

08:25 BST

Joe Tidy
Cyber correspondent

The fact that researchers used frontier AI models to discover as yet hidden flaws should have been a good news story.

Researchers at Calif, Wiz and OpenAI used the best version of ChatGPT to uncover a method of attack that they said was "a complex chain of steps, at the edge of what human researchers could practically achieve".

They then worked together to come up with a way to fix it to make PHP better.

The security patch was due to be announced and rolled out in the normal civilised way patches usually are.

Then it all went wrong.

In the words of PHP Foundation, "coordinated disclosure of these vulnerabilities worked well" until two days ago.

Someone leaked some basic details about the potential flaws and hackers started trying to figure out how to exploit them.

Then, according to PHP Foundation, Calif accidentally posted a video about the hack.

Criminals immediately began coming up with methods and that’s what caused the rush and panic across the cyber world.

Image source, Reuters

Cyber-security firm Wiz estimates that "roughly 70%" of the internet is affected by the PHP flaws.

We haven't been able to verify that figure but here's what we can say about some of the websites that have reported issues around the globe.

• Amazon says it has detected an attempt by hackers to exploit the flaws but so far its websites are operating as normal
• The website of Dutch government agency the National Institute for Public Health and the Environment is currently down
• Another Dutch agency, specialising in cybersecurity, went offline as a precaution but is now running again

• Danish IT company Kombit shut down multiple services, including the national school communication platform

• Finland's government closed its public web services but is back online again
• Wikipedia also took down parts of its website

Osmond Chia
Business reporter

The scale of the PHP warning is hard to comprehend, but few cyber-security alerts have caused such panic.

The security concerns affect millions of web pages that run on PHP, potentially allowing a way for hackers to steal sensitive data or take control of websites.

The software powers platforms like WordPress - the content management system behind blogs and other text-heavy pages - Wikipedia and online shops.

That is why companies are racing to secure their platforms, while governments around the world urge websites to take action.

Image source, Getty Images

One of the world's largest intelligence agencies is warning that affected organisations should take their systems offline until a fix is in place.

In a post on X, the cyber division of the US National Security Agency says those using PHP should immediately prepare "for an update addressing two critical vulnerabilities".

It explains: "PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database.

"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated."

The PHP flaws were initially found by humans back in 2024, Alan Woodward tells Radio 4's Today programme, but they thought they looked "too complicated to exploit".

As large language models - a type of artificial intelligence (AI) - became more sophisticated, "people worked out how to exploit [the flaw]", the cyber security professor says.

"People have been scrambling away saying: 'Actually, yes, you can exploit it and we now need to patch it'," Woodward explains.

Part of the problem is that "the cat was let out of the bag rather earlier than it was supposed to have been," he says, adding that somebody revealed the PHP flaws before the patch - an update to fix the issue - was made public.

Asked whether it has led to hacking attempts, Woodward says companies like Amazon and Cloudflare that monitor what is going on online saw the weakness "was being probed for".

He adds: "We don't know whether [sites have] been attacked but certainly people were probing websites to see: have you got that flaw?"

The cyber-security flaws identified in the PHP programme language mean an attacker can "get their own code onto the web server" and "basically do whatever they like", says Alan Woodward, professor at the Surrey Centre for Cyber Security.

He tells Radio 4's Today programme this could include things like stealing personal data, going to other parts of your network, or planting a backdoor to gain access later on.

Referencing the "serious" scale of it, he says it could affect "something like 30 million websites".

Image source, PA Media

As we reported earlier, the UK government says it is working to identify any potential exposure in its online services.

A UK government spokesperson urges "all organisations, private and public, large and small" to follow guidance to protect their systems.

The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia, earlier urged those who use PHP to apply the fixes.

"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note, external.