Global Cybersecurity Alert As Vulnerability Puts Millions Of Websites At Risk

Global Cybersecurity Alert as Vulnerability Puts Millions of Websites at Risk Organisations around the world are racing to secure their websites and computer systems following the discovery of critical vulnerabilities in PHP, a programming language that powers a large proportion of websites globally. The security flaws, uncovered with the assistance of artificial intelligence, could allow attackers to execute malicious code on vulnerable servers without authentication, potentially enabling them to steal sensitive information, alter website content or take control of affected systems. The vulnerabilities have triggered an international cybersecurity response, with technology companies, government agencies and website operators working to install security updates and reduce exposure. PHP is used by major online platforms and content-management systems, including WordPress, Drupal and Joomla. Wikipedia’s MediaWiki software also relies on PHP, meaning the weaknesses could affect a broad range of websites. The vulnerabilities, known as PHP2Shell, affect PHP itself rather than a single website or application. Security researchers have warned that successful exploitation could expose passwords, authentication tokens and other sensitive data, as well as allow attackers to execute commands on affected servers Cybersecurity firm Wiz estimates that PHP underpins about 70 per cent of websites worldwide, while separate industry analysis identified more than 22.6 million internet-exposed instances potentially vulnerable to the flaws. The exact number of affected websites remains uncertain. Amazon reported attempts to exploit the vulnerabilities against its decoy systems, including activity recorded before the public disclosure on October 21. Meanwhile, Wikipedia and several government organisations temporarily took some systems offline while security updates were applied. Cybersecurity agencies in the United Kingdom, United States and European Union have urged organisations to identify vulnerable systems and install the available security patches without delay. The European Union Agency for Cybersecurity warned that organisations unable to apply fixes immediately should consider isolating exposed applications from public networks until the vulnerabilities are addressed. The PHP development team released security updates on October 21, 2026. Experts say organisations should also review server logs for suspicious activity and investigate possible signs of compromise, as installing a patch alone may not address an intrusion that has already occurred. The incident has highlighted the dual role of artificial intelligence in cybersecurity: helping researchers uncover longstanding software weaknesses while also making it easier for malicious actors to develop and adapt exploits.