A global race against time is underway as tech teams rush to patch two critical security flaws in PHP, the foundational programming language powering nearly 70% of the world’s websites.
The vulnerabilities, which have gone undetected for over a decade, were discovered by researchers using advanced AI models through OpenAI’s “Patch the Planet” initiative.
The security crisis escalated dramatically following an unexpected leak of the flaw’s technical specifications on social media. The premature exposure prompted the PHP Foundation to rush out emergency updates alongside urgent warnings from international intelligence bodies, including the UK’s National Cyber Security Centre (NCSC) and the US National Security Agency.
Officials have warned that because the flaw allows unauthenticated remote code execution, giving hackers a direct path to hijack databases and file systems without passwords, organisations unable to apply the updates immediately must take their digital infrastructure offline.
In the UK, the preventive fallout has disrupted major public services, local government hubs, and entertainment networks. The Office for Budget Responsibility (OBR) was among the first high-profile bodies to deliberately take its primary website dark, stating the move was a necessary precaution “in view of the critical security issues affecting PHP”.
Local government portals experienced severe disruption, with Edinburgh, Oxford, Hillingdon, and Oxfordshire County councils pulling their websites offline to isolate their systems while IT specialists investigated and deployed the critical software fixes.
Meanwhile, major media portals are also feeling the pinch; public landing pages for several of the BBC’s most popular television programmes, including Doctor Who and The Traitors, unexpectedly became inaccessible as internal systems were shut down for emergency maintenance.
A UK government spokesperson confirmed that Whitehall is actively working to identify potential exposure across all public sectors. “Work is already under way across government to actively identify and patch any potential exposure,” the spokesperson stated, urging “all organisations, private and public, large and small” to follow the NCSC’s guidance immediately.
The impact stretches far beyond British borders, however, with French government ministries, the Dutch parliament, and the Port of Rotterdam all taking sites offline. Cybersecurity firm Cloudflare reported tracking “millions” of automated exploit attempts within hours of the leak, as malicious actors use AI tools of their own to weaponise the code. Experts warn that while many UK systems are successfully returning online after applying the patches, the incident marks a definitive and volatile turning point in AI-driven cyber warfare.
Related stories
AWS global outage triggers warning over hack attacks
Ransomware victims who pay up are nearly all hit again
UK firms braced for fresh wave of ransomware attacks
UK firms still in dark over new cyber security measures
Major brands warned over extortion after global attack
Be the first to comment on "Security flaw forces websites offline around the world"