Websites around the world taken down to protect systems - as critical software update issued

Government and business websites around the world were taken down in a bid to protect organisations after a critical software update was issued over vulnerabilities in programming language.

The developers of the PHP programming language, which is extensively used across the internet, said on Wednesday a set of new ​updates fixing two previously identified critical vulnerabilities was now ​live.

It strongly encouraged ‌users to update software immediately - leaving tech teams around the world scrambling to patch the critical flaw.

Those unable to apply key fixes should consider taking their websites down, UK and international cyber security officials have warned.

PHP is used by almost 70% of websites, according cyber security firm Cloudflare, and underpins popular platforms such as WordPress and Magento.

AI agents helped uncover the vulnerabilities.

OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers to address the flaw in PHP, and supported its developers as it led the fixes.

The company described the incident as "one of the most impactful security issues in recent memory", adding that while AI can help to uncover issues, it can also aid attackers.

The Office for Budget Responsibility (OBR) in the UK said it had taken its website offline "in view of the critical security issues affecting PHP".

While websites linked to French, Danish, Finnish and Dutch governments all appeared to go offline on Wednesday as organisations rushed to protect their systems. Some are now back up and running.

Concerns have escalated in recent days that websites running software would be exposed to serious cyber intrusions.

PHP said both vulnerabilities were rated 9.2 out of 10 on the CVSS v4.0 severity scale.

Read more:
Speaker scolds government for treating media as 'more important' than MPs
Australian MP has both legs amputated, husband confirms

How countries were affected

Earlier France's Interior Ministry said it had placed all of its websites into preventive maintenance. Users visiting French government websites were told there was "ongoing maintenance".

In the Netherlands, several organisations took public-facing websites offline, while Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.

The Czech government took its website ‌offline on Wednesday evening.

And disruption ​was also widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline "as a precautionary measure".

Cyber security agencies in Britain and Japan are also among those urging PHP users to update immediately or take websites offline until patches can be applied.

A government spokesperson said: "Work is already under way across government to actively identify and patch any potential exposure.

"We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."

The US ​National Security Agency said in a statement the vulnerabilities "often provide ​a direct path to the server's file system or database," and ⁠that if an immediate update was not feasible, organisations should take systems offline for full mitigation.

The Australian Cyber Security Centre (ACSC) urged organisations to ​identify PHP systems in their environments, prepare to apply patches and monitor applications for ​signs of malicious activity.

Hacking could become 'more widespread now'

Speaking to Matt Barbet on Sky News' The World, cyber security expert Alp Toker, director at Netblocks, warned the issue was "really impactful because it means that anybody on the web can essentially access your web server if you're running the software, PHP, which is a very, very, popular, web server software".

Mr Toker said disruption caused by nefarious actors so far has been "limited", but he warned it could now become "more widespread".

"So far it's been very limited because the people who found the vulnerability kept it under wraps for quite a while, but in the last few days it has been seen in the wild," he said.

"It is something that is going to become much more widespread now. Now the patch is out, AI agents can learn from that patch and reproduce the attack much more easily."

The ‌Wikimedia Foundation, which ‌runs online encyclopedia Wikipedia, was one company on Wednesday which said it was ‌in the process of addressing ​security vulnerabilities in the PHP programming ​language.

While Oxfordshire County Council and Hillingdon Council both separately said their websites were offline as a precaution due to the worldwide issue while they investigate.

On Tuesday, the European Union ‌Computer Emergency Response Team (CERT-EU) said the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that could allow attackers to run malicious code on vulnerable systems without logging in.

It urged organisations to prepare for the immediate patching of affected assets.

(c) Sky News 2026: Websites around the world taken down to protect systems - as critical software update issued