PHP issues affect websites across the world — all the latest updates, and what you need to know

Websites across the globe are scrambling to ensure they are protected against possible cyberattacks this morning.A potentially critical security flaw in the PHP programming language has meant organizations around the world need to update their systems immediately, with hackers ready to strike. PHP has issued a series of patches which it says mitigates the issue, but users are reporting issues with some websites across the globe - we're tracking the story as it develops, and you can follow our updates here. 2026-10-22T09:17:34.685Z Has anyone been hacked? There's also no evidence that hackers have been able to gain access to systems or company resources - yet.There was a fear that criminals tipped off by PHP's "heads-up" warning may have used this time to target vulnerable websites - with Amazon reportedly detecting a hacking attempt. However this doesn't appear to have materialized on a large scale.Companies which don't apply the updates immediately though could well see issues over the next few days, as hackers will be searching for easy targets. (Image credit: Shutterstock / Sashkin) 2026-10-22T09:14:38.339Z What has actually happened? It's important to note that despite widespread headlines so far, the issue with PHP hasn't led any companies or websites to be hacked - yet.Instead, many organizations have been forced to take down individual pages or even entire websites in order to apply the patches released by PHP to fix the issue, meaning users are unable to access certain resources. So far, some government websites in Scotland and the Netherlands have gone offline briefly, along with a Danish IT firm which provides the nation's school communication platform.Wikipedia and its content store site Wikimedia also saw some outages, but both appear to be back online now. 2026-10-22T09:10:45.595Z PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online. PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years. 2026-10-22T09:06:57.865ZNews of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems.The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release."