Hot right now
2 stories

PHP flaw

PHP runs about 7 of every 10 websites on Earth. On 21 October 2026 its developers rushed out a fix for two flaws that let an attacker take over a server with no password, and governments and sites including Wikipedia switched themselves off rather than risk it.

New to this? A flaw in the code behind most websites forced governments and Wikipedia offline

Live updates

  1. PHP shipped emergency fixes 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two flaws rated 9.2 out of 10. Canada took down federal sites, US and European cyber agencies told site owners to go offline, and Wikipedia, Pinboard, 4chan and Something Awful went dark while they patched. Read the story

  2. World leaders issued fresh warnings over the PHP security flaw as the global patching effort ran into a second day. Read the story

  3. CNN reported the flaw was found using AI tools and affects roughly 7 in 10 websites that run on PHP, forcing many site owners to shut down pages while they patched. Read the story

  4. A Reuters factbox named more governments taking sites offline beyond Canada, including the Netherlands, Germany, France, Belgium and Finland, plus Dutch hospitals, a football association and political party sites. Read the story

Explained

The internet had its worst Wednesday ever. Then a master key turned out to be 4

On Wednesday 21 October 2026, two flaws in PHP, the code behind about 7 in 10 websites, pushed governments, Wikipedia and the Port of Rotterdam offline. The same day a popular AI tool shipped a password stealer, the developer platform Railway paused every deployment, and India's biggest bank reported a data loss. Days earlier, a company that vouches for websites was found using a secret key that was simply the number 4. Here is the full list, with what each one means for you.

Read the story