'Millions' of exploitation attempts as 'critical' flaw hits websites

Disruption from a "critical" flaw that led to websites around the world being taken down could become "more widespread", an expert had told Sky News.

A number of government and business websites went offline on Wednesday as a security measure after a critical software update was issued over vulnerabilities in PHP, a programming language used extensively across the internet.

The developers of PHP said that a set of new ​updates fixing two previously identified critical vulnerabilities was now ​live, and strongly encouraged ‌users to update software immediately.

It led to tech teams around the world scrambling to patch the critical flaw, while cyber security officials said that those unable to apply the fixes should consider temporarily taking their websites down.

The cloud services company Cloudflare has revealed it has seen millions of exploitation attempts since the fault was disclosed - a figure likely to grow further in the hours and days ahead.

Cloudflare CEO Matthew Prince wrote on X: "In the 10 hours before it was publicly ​announced, across the network we saw ‌thousands of attempts to exploit it. That jumped to tens of ​thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions ​now."

Amazon Web Services also said this flaw is now "being broadly exploited in the wild" - and has revealed that suspected hackers tried to capitalise on the vulnerability days before it was publicly announced.

Alp Toker, a cyber security expert and director at NetBlocks, called the issue "highly impactful" - and warned the disruption caused by nefarious actors, which has so far been "limited", could become "more widespread".

Speaking to Matt Barbet on The World, Mr Toker explained that the incident "means that anybody on the web can essentially access your web server if you're running the [PHP] software".

He said that the risk had been "very limited because the people who found the vulnerability kept it under wraps for quite a while, but in the last few days it has been seen in the wild".

Mr Toker added that AI agents could "reproduce the attack much more easily", warning that it is "just the beginning of a wider wave of attacks".

"These systems are going to continue to get compromised - month after month, year after year," he said.

'Critical security issues'

Websites linked to governments across Europe went offline on Wednesday as organisations rushed to protect their systems, although some are now back up and running.

In the UK, the Office for Budget Responsibility (OBR) said it had taken its website offline "in view of the critical security issues affecting PHP".

Oxfordshire County Council and Hillingdon Council both separately said they had temporarily taken down their websites as a precaution while they investigate.

A UK government spokesperson said work was under way to "identify and patch any potential exposure".

They added: "We encourage all organisations - private and public, large and small - to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems."

Meanwhile, the US ​National Security Agency and the Australian Cyber Security Centre both urged organisations to remain vigilant and apply updates where possible.

The ‌Wikimedia Foundation, which ‌runs online encyclopaedia Wikipedia, was one company on Wednesday that said it was ‌in the process of addressing ​security vulnerabilities in the PHP programming ​language.

More from Sky News:
Why is Poland reopening Cold War bunkers?
Law must be updated to protect 'backbone' of UK

PHP widely used

PHP is used by almost 70% of websites, according to cyber security firm Cloudflare, and underpins popular platforms such as WordPress and Magento.

It said the two vulnerabilities found, which AI agents helped to uncover, were rated 9.2 out of 10 on the CVSS v4.0 severity scale.

OpenAI, which runs ChatGPT, said it has been leading a team of researchers to address the flaw in PHP over the past two months - and supported its developers as it led the fixes.

The company called the incident "one of the most impactful security issues in recent memory", adding that while AI can help to uncover issues, it can also aid attackers.

On Tuesday, the European Union ‌Computer Emergency Response Team (CERT-EU) said the 9.2 rating indicated a risk of unauthenticated remote code execution, a type of flaw that could allow attackers to run malicious code on vulnerable systems without logging in.

It urged organisations to prepare for the immediate patching of affected assets.

(c) Sky News 2026: 'Millions' of exploitation attempts as 'critical' flaw hits websites