PHP issues affect websites across the world — all the latest updates, and what you need to know

Websites across the globe are scrambling to ensure they are protected against possible cyberattacks this morning.

A potentially critical security flaw in the PHP programming language has meant organizations around the world need to update their systems immediately, with hackers ready to strike.

PHP has issued a series of patches which it says mitigates the issue, but users are reporting issues with some websites across the globe - we're tracking the story as it develops, and you can follow our updates here.

October 22, 2026 – 5:06 AM News of the issue first broke yesterday, when PHP notified the security world of two critical vulnerabilites detected in its systems .

The flaws could expose countless sites to remote code execution (RCE) attacks, which could then lead to website takeovers, data theft, malicious redirects, and other similarly sinister situations.

PHP then published a security advisory giving admins a “heads up” on an incoming patch, as well as, "advance notice of an upcoming security release." October 22, 2026 – 5:10 AM What is PHP? PHP: Hypertext Preprocessor, or PHP, is among the most popular programming languages for websites and web applications in the world, so when remote code execution zero-days are found, it’s a big deal.

In its most basic form, when a user clicks on a website, PHP bring togthers the information you need, and presents it in a way you can read online.

PHP is not a new system - it has been around for decades, but as with many such crucial code systems, it flies under the radar somewhat, meaning potential flaws or issues can go undetected for years.