PHP security vulnerability triggers global cyber alert; millions of

22 October, 2026, 05:15 pm

Last modified: 22 October, 2026, 05:17 pm

A major global cybersecurity alert has been triggered by a decade-old PHP security vulnerability that could expose millions of websites to cyberattacks, data theft, and server takeover.Security researchers at Calif and Wiz used artificial intelligence to uncover the flaw, prompting emergency security patches and temporary shutdowns affecting selected services from Wikipedia's parent organisation, Wikimedia, and the BBC. The US National Security Agency warned of potential database exploitation, while Britain's National Cyber Security Centre urged organisations to check for attacker backdoors.As cybersecurity agencies respond, website administrators are urged to install the latest PHP security patches or temporarily disconnect vulnerable systems. Users should also remain alert to suspicious password reset notifications and phishing attempts.