TL;DR
UK government officials are working out whether any public online services are exposed to critical flaws in PHP, the programming language behind a large share of the web, the BBC reported on 22 October. The flaws were first found with the help of AI. The National Cyber Security Centre (NCSC) has told organisations that cannot fix them immediately to consider taking affected systems offline.
What the UK is doing
A government spokesperson urged organisations of every size, public and private, to follow the official guidance. Like the equivalent agencies in Australia and the EU, the NCSC has called on PHP users to apply the fixes, and said: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”
Some UK bodies have done just that. The Office for Budget Responsibility took its website down, citing “the critical security issues affecting PHP”. The BBC says council websites in Oxford and Edinburgh were down on Wednesday 21 October before coming back.
Prof Alan Woodward of the Surrey Centre for Cyber Security told Radio 4’s Today programme that around 30 million websites are affected, and that an attacker could run their own code on a server, steal data or plant a backdoor. Wiz has put the share of the internet affected at “roughly 70%”, a figure the BBC says it cannot verify.
How AI found it
OpenAI says it spent two months leading a coalition to handle the response. In its account, the security firm Calif found a critical flaw using GPT-5.6 Sol under OpenAI’s Patch the Planet programme, while Wiz found both vulnerabilities on its own. PHP’s maintainers wrote and released the fixes. OpenAI calls it “one of the most impactful security issues in recent memory”.
The planned timetable slipped. The BBC reports that details appeared on social media on Tuesday 20 October, before the PHP Foundation’s intended disclosure. Amazon said it saw an exploitation attempt against a decoy system on 17 October and further attempts on 21 October from what appeared to be several different actors. Its security chief, CJ Moses, warned that AI lets “more actors” move “within hours or even minutes” once a flaw is public.
Looking forward
OpenAI says it expects findings like this to “increase sharply in the coming months” and has published a draft framework for coordinating disclosure, which it wants the security community to critique. For UK organisations, the immediate job is simpler: find every PHP installation, including those run by hosting providers and agencies, and check it is patched. In our view, this case shows that a planned disclosure date can be overtaken by a leak, so businesses should not wait for the official timetable before acting on a flaw in a widely used component.