What is PHP? Software security vulnerability explained - and why cybersecurity issue brought down so many websites

What is PHP? Software security vulnerability explained - and why cybersecurity issue brought down so many websites

A critical security vulnerability in PHP, the programming language behind nearly 70 percent of all websites, has prompted councils, government bodies, and major platforms to take their services offline as a precaution. The flaw allows remote code execution, meaning attackers could bypass security measures and run unauthorised code directly on affected servers. Security researcher Ryan Austin discovered the issue in August using an artificial intelligence tool from OpenAI, and details became public on October 20. Within hours, hacking attempts spiked from thousands to millions, according to web security firm Cloudflare. Edinburgh and Oxford city councils, parts of the BBC, and the Office for Budget Responsibility were among those temporarily shutting down services. A fixed version of PHP is already available, and the National Cyber Security Centre has urged all organisations to upgrade immediately or remain offline until patched. For ordinary users, there is no personal device update, but officials advise watching bank accounts for unusual transactions and enabling multi-factor authentication on email, shopping, and financial accounts.