One serious cyber-security warning don put millions of websites wey dey run on PHP on alert, as companies dey race to secure their platforms and governments around the world dey urge websites to act. The security concerns affect millions of web pages wey dey use PHP, and e fit open way for hackers to steal sensitive data or take control of websites.
PHP dey power platforms like WordPress, Wikipedia and online shops. WordPress na content management system wey dey behind blogs and other text-heavy pages. Na why companies dey rush to secure their systems, while governments around the world dey tell websites make dem take action.
The cyber division of the US National Security Agency, for one post on X, warn say people wey dey use PHP suppose immediately prepare “for an update addressing two critical vulnerabilities”. The agency explain say PHP dey widely used for web applications, and the vulnerabilities often dey provide direct path to server file system or database. E add say if immediate update no feasible, e recommend make organisations take the system offline until dem fully mitigate am.
Alan Woodward, professor at Surrey Centre for Cyber Security, tell Radio 4’s Today programme say people first find the PHP flaws back in 2024, but dem think e look “too complicated to exploit”. As large language models, one kind artificial intelligence, become more sophisticated, people work out how to exploit the flaw, e talk. “People have been scrambling away saying: ‘Actually, yes, you can exploit it and we now need to patch it’,” Woodward explain.
E talk say part of the problem na say “the cat was let out of the bag rather earlier than it was supposed to have been,” and somebody reveal the PHP flaws before the patch, an update to fix the issue, was made public. Asked whether e don lead to hacking attempts, Woodward say companies like Amazon and Cloudflare wey dey monitor wetin dey happen online see say the weakness “was being probed for”. E add: “We don’t know whether [sites have] been attacked but certainly people were probing websites to see: have you got that flaw?”
The cyber-security flaws mean one attacker fit “get their own code onto the web server” and “basically do whatever they like”, Woodward talk. E say this fit include stealing personal data, going to other parts of your network, or planting backdoor to gain access later on. Referencing the “serious” scale of the matter, e say e fit affect “something like 30 million websites”.
The NCSC dey encourage UK organisations to take immediate action to mitigate security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
