Websites taken down worldwide as critical cyber-security update issued

Image source, Getty ImagesByTom Gerken and Laura Cress, Technology reporters and Joe Tidy, Cyber correspondent, BBC World ServicePublished21 October 2026International governments and agencies have urged websites to address two critical cyber-security flaws in a programming language which powers much of the internet.

The vulnerabilities were found within the PHP programming language, with a fix issued on Wednesday afternoon.

Multiple cyber-security agencies have urged organisations unable to apply fixes in time to consider taking their sites down, leaving bodies such as the Finnish government, Edinburgh council and the BBC to take pages offline.

The flaws were discovered by AI, with cyber-security firm Wiz saying they were the "most severe vulnerabilities ever discovered" by the tech, which is reshaping the cyber landscape.

Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.

The US National Security Agency issued similar advice on X, external for organisations to take their systems offline if they were unable to update with the fix.

"These vulnerabilities often provide a direct path to the server's file system or database," it wrote.

Meanwhile, the White House said federal agencies were working with leading AI labs to speed up a fix to the issue.

And in a post on X, external, Japan's Prime Minister Sanae Takaichi urged people to check if their publicly available websites ran on PHP.

The Wikimedia Foundation, which runs the online encyclopedia Wikipedia, said it was addressing the security vulnerabilities.

"We have taken down a number of other systems as a precautionary measure until they can be safely patched," it said.

Edinburgh council's website has also become inaccessible, as well as the online homes for several BBC programmes including Doctor Who and The Traitors.