In brief
Security researchers have issued a warning that a critical vulnerability in the PHP core—used across a large portion of the web—could allow attackers to gain root access. Nations from Finland to the United Kingdom have taken high‑profile sites offline while patches are rolled out. The flaw was identified by OpenAI‑backed firms using AI to probe PHP code. Experts urge organisations to immediately patch or suspend the affected software as early attacks are appearing. PulseWire tracks live reports and cross‑checks downtime across map‑based dashboards.
October 21, 2026 – PulseWire News
A critical flaw in the PHP programming language has forced the Finnish government, the Netherlands’ national agency, the BBC and other high‑traffic sites to pull offline until a patch arrives. The vulnerability was discovered by AI tools run by firms such as Wiz and Calif, part of OpenAI’s Patch the Planet initiative. It is said to be the most severe bug uncovered in years, potentially giving attackers direct access to a server’s core file system or database.
According to the U.S. National Security Agency, organizations unable to update immediately should consider taking sites offline until the fix is applied. The National Cyber Security Centre in the UK and its European and Australian counterparts echoed the same guidance, warning that PHP versions dating back to 2004 could be affected.
The PHP Foundation has released an update for the most recent releases only; users on older versions such as PHP 8.1 are urged to upgrade as soon as possible. Analysts estimate that roughly 70% of the internet could be vulnerable. That estimate, announced last week, was based on AI‑generated exploits that automatically adapt across thousands of PHP‑based applications.
High‑profile outages include the online homes of BBC programmes such as Doctor Who and The Traitors, the Edinburgh council website, and Finland’s public web services portal. In the Netherlands, the government’s EC “National Institute for Public Health and the Environment” temporarily shut the agency’s website. Wikipedia is also patching the issue, having taken down certain systems as a precaution.
Japan’s Prime Minister Sanae Takaichi has urged citizens to verify whether their public sites run on PHP, and the White House has deployed AI labs to expedite a fix. Huntress and other security firms flag PHP as ubiquitous, powering not only WordPress but also Drupal, Joomla, Magento, and countless hidden server‑side scripts. Cyber‑attackers targeting these systems could install malware, seize control, or broker widespread downtime.
PulseWire contributors are monitoring active websites and compiling a real‑time map of affected services. Community members report outages to our verification channel, helping to confirm whether sites have been properly patched. If you encounter a site that is unexpectedly unavailable, please share evidence on our fact‑checking thread for immediate review.
What users should do now:
- Check your site’s PHP version under the hosting control panel.
- Download the latest official PHP update from the PHP Foundation.
- Create a full backup before applying the patch.
- If the update cannot be applied immediately, consider taking the site offline until remediation.
- Keep an eye on PulseWire’s live dashboard for new patches or emerging attack vectors.
Stay tuned for continuous updates, including a detailed breakdown of affected industries and real‑time patch status across the globe.
By Tom Gerken, Laura Cress & Joe Tidy – Technology reporters; for PulseWire News.
