Madeleine Lake
Live reporter

Image source, Reuters

Around the world organisations have taken down websites as they attempt to fix a cyber-security flaw in something called PHP - which helps run around 70% of sites.

Invisible, but essential: our cyber correspondent describes PHP as a key part of "invisible infrastructure", and if it's vulnerable cyber criminals can use it to deface websites, extract data and plant malicious software. These are "worse-case scenarios" he says, and an expert adds there are no signs of breaches so far.

When would you use it? Our technology reporter says when you visit a site, PHP helps deliver what appears by fetching and processing information from its databases.

What's gone wrong? The vulnerability is within the PHP programming language, which collects information you need and presents it in a way you can read on the web. Companies have been implementing a fix, but researchers say many are still vulnerable.

Government services unavailable: Baroness Lloyd of Effra said in the House of Lords that 32 UK government services were unavailable and four partially unavailable - but no large public-facing critical services have been affected.

The global scramble: the effect has been seen in countries including Japan, Finland and France. Read about the actions they've taken.

Back to basics for some smaller businesses: while there has been a rush to get some websites down, garage owner Dean steered to a simpler method of using pen and paper - but it means his team are in for a later finish.

• We're ending our live coverage now, but you can read more in our news story

Rozina Sini
BBC News

Throughout the day, we've been hearing from you about the impact this cyber-security issue has had.

Catherine Charles, a conveyancer in London, told us earlier it's affected her online Law Society course.

She said the system kept telling her it's undergoing "essential maintenance" which she suspects was caused by the flaw affecting millions of websites.

Another student in London told us he faced disruption to his studies after losing access to his university platform which contains his calendar, PowerPoint slides, and submission panels.

Milan Pitamber said the disruptions have caused "lots of panic and confusion".

To understand how PHP works, we’re taking you to a restaurant.

Think of going online to visit a website like ordering some food.

When you enter the site, the web server takes your request and runs the PHP code - like a waiter taking your order to the kitchen.

The PHP code searches the site's database and follows a script to prepare the page - like a chef following a recipe to make a meal.

When complete, the web server then delivers the page to the browser, and it appears on screen - that’s your waiter bringing you your dish.

PHP code is used across a wide array of online platforms, including WordPress, as well as Wikipedia and online shops. According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites.

Image source, AFP via Getty Images

Experts say the critical security flaw in the PHP programming language has disrupted services globally.

We looked at some of the companies and organisations affected in our earlier post, and we're continuing to learn about more about its effect around the world:

• A number of Japanese of companies including airliner ANA, brewer Asahi Group Holdings and insurance company Tokio Marine Holdings suspended some websites and services as a "precautionary measure"
• Finland's national broadcaster YLE reported that Valtori - its state IT services provider - had taken some sites down and was updating overnight starting on Wednesday evening
• In France, telecommunications company Orange also said it had suspended access to certain services globally while it deployed security patches
• Chinese cloud-computing provider, Tencent Cloud, urged customers to install updated PHP versions, although held off calling for websites to be shut down

Image source, Reuters

"I consider this one of the most serious incidents of the past two years," Haya Schulmann, the scientific director of the Fraunhofer innovation platform for cybersecurity, tells the Reuters news agency.

And despite describing the situation as "manageable", Schulmann warns developments in AI have reduced the bar needed to exploit and "weaponise" IT vulnerabilities.

She says: "The risks are real and we should not, especially the vendors, should not postpone developing patches."

Germany's cyber-security authority - the Federal Office for Information Security - says in an update this afternoon it has received no reports of any successfully compromised IT systems in the federal administration.

"However, successful attacks cannot be ruled out at the moment," it adds, and adding government websites that were taken down "as a precaution" are now "mostly available again".

Joe Tidy
Cyber correspondent

Cyber-security researchers using scanning tools to check for servers at risk of the PHP vulnerability say the number is going down fast but there are still many at risk.

With a security patch being available, organisations have been downloading it at speed as news has spread.

Lloyd Davies CEO of Infrawatch has been sharing regular updates and says the number of patched systems is going up fast from 3.10% in the UK at around 10:00 BST to 5.34% at 15:30 BST.

Globally the patch rate is not growing as fast with 4.21% of systems fixed and protected from hackers.

Whilst promising, the numbers are still low which means there are many millions of websites and web servers at risk of the PHP flaw.

"We can see all the major providers have already upgraded their estates," Davies says.

It’s not surprising that large organisations are able to respond rapidly as they are likely to have large IT teams.

Smaller firms won’t have the IT departments to react in such a manner and might be one of many other at-risk organisations in a queue being worked through by an IT management company.

Rozina Sini
BBC Your Voice

We've been hearing about how this cyber-security issue has been impacting you.

Matthew Jeans in Wakefield told us earlier it has been impacting his login access to video games on his PC.

"Several popular games and services have been affected, including Final Fantasy XIV, Pokémon HOME, Pokémon Sleep and multiple Cygames titles," he said.

He said the issue had been affecting PC players primarily because they go through the login servers.

He adds: "The games are up and running if you’re using a console but if you're logging on through a PC you can't.

"So I suppose I better get on with some housework."

Image source, Getty Images

Canada's government says there is "no indication" any of its systems have been compromised as a result of PHP's global cyber-security flaw.

It became aware of "two critical vulnerabilities" affecting PHP on Wednesday, it says.

"Under certain conditions," it says, these vulnerabilities "could allow a malicious cyber actor to run unauthorised commands on affected systems without authentication."

Security updates are now being applied to address the issue, which means that some government websites may be unavailable or experience service disruptions, it says.

"There is no indication at this time that any Government of Canada systems or information holdings have been compromised," it says.

Joe Tidy
Cyber correspondent

Cyber-security researchers are observing an unusual element to the story - cyber-crime forums are also offline as a result of the PHP emergency.

Even as law-abiding organisations and institutions work to protect themselves from hackers - the hackers are also working hard to make sure their own websites are not vulnerable.

"Underground forums commonly depend on PHP-based software and supporting plugins, making remotely exploitable vulnerabilities a potential threat to both platform and its operators," says Sophos expert Rebecca Taylor.

Cyber criminals operate on the dark net or on the clear net relying on complex layers of protections to keep themselves anonymous, so having their websites breached by rival groups or law enforcement is a big risk.

Many a cyber criminal and group has been brought down after their website was infiltrated by police.

For example, the notorious ransomware group LockBit were heavily disrupted in 2024 by the National Crime Agency after cyber cops snuck into their internal systems unmasking members and stealing back stolen bitcoin.

Tomos Morgan
BBC News

We've spoken again to Dean, who owns an auto repairs in Chepstow, who for the last 24 hours has been unable to process MOTs online.

He tells me it's been an "inconvenience" but "these things do happen a few times a year".

However this time has been different, he says, mostly because these outages usually only happen for "two to three hours at a time".

In the meantime it has been back to pen and paper.

Now the system is back online Dean and his staff will have to stay on later tonight because they’ll have to input the MOT’s online that were done on paper earlier, he says.

Liv McMahon
Technology reporter

PHP refers to PHP: Hypertext Preprocessor. It’s a back-end programming language that runs on a web server. It was developed in the early 1990s to help serve dynamic web pages, but still powers lots of platforms today.

When you visit a website, PHP essentially helps to deliver what appears on the page by fetching and processing information from its databases.

The popular programming language is used across a wide array of online platforms, including WordPress, as well as Wikipedia and online shops.

According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world’s websites. And it said the flaws - now coined "php2shell" - were inherent in the language itself, affecting many versions of it.

The PHP Foundation, the non-profit that maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to execute code on servers running PHP.

It has urged those running it to update now to prevent the vulnerability being exploited on their platforms.

Image source, Reuters

The chief executive of Microsoft says he has "not seen anything like this in a long, long time".

Referencing ongoing efforts to fix the critical cyber-security flaw, Satya Nadella says that "it was a long day and a long night, I know, for all the IT and security folks".

Nadella, speaking at a company AI event in Cologne, adds the incident is "a reminder" to think about how various parts of a system depend on each other, rather than just looking at individual components.

He pays tribute to "all the hard work that all the IT professionals, all the security professionals, do everywhere in the world in times like this".

Jaltson Akkanath Chummar
Asia business producer

The Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) has warned that multiple vulnerabilities have been identified in PHP and those vulnerabilities are "being exploited in the wild".

It advises organisations to patch all affected assets immediately, and if that’s not possible they should consider isolating "internet-facing applications from public networks until the security fixes are applied and verified".

The agency issued an "extremely high risk" warning on Thursday along with steps that organisations could follow to patch the vulnerabilities.

Image source, hkcert.org

Large companies normally have big IT departments and plans in place for this sort of thing, but smaller companies "are much more vulnerable", warns Charlotte Wilson of cyber-security firm Check Point Software.

She tells Radio 4's World at One programme what these smaller companies should be doing right now:

• Make a call to whoever manages your website - which may be an external organisation. Wilson says you need to find out if the website uses PHP and if you're affected. If so, do they have a plan in place and has this been applied?
• Don't assume anybody else has fixed it. Wilson notes that, even if you have a website hosting provider who oversees the underlying infrastructure, your business could still be responsible for using its software
• Back up your website. Check that you can restore it too, so that if something goes wrong and you need to recover it quickly, you have a protected copy separate from your live website
• Keep a watchful eye moving forward. Wilson recommends keeping a monitor on your website to pick up suspicious behaviour even after you've patched the problem. While there's not been evidence of successful hacks so far, she cautions that you normally don't know someone's managed it until things go wrong

David Lloyd Clubs has confirmed its app is down due to the ongoing PHP incident affecting millions of websites worldwide.

The gym group responded to a member on X who complained they were unable to book classes, saying: "Due to a global outage affecting organisations around the world, our app is temporarily unavailable while precautionary updates are carried out."

David Lloyd Clubs says its locations remain open and that members can book classes in person.

Image source, House of Lords

More now from technology minister Baroness Lloyd of Effra on the government's response.

"Whilst we have heard reports of exploitation activity and scanning internationally, we are not aware of any compromises in the UK public sector or in the UK as such," she says.

The technology minister once again urges both the public and private sectors to increase cyber resilience "by taking the measures that we have suggested".

Those measures, she says, include "signing up to early warning systems...understanding fully your supply chains, and ensuring that they all meet the requisite standards of cyber resilience".

Ollie Whitehouse, the chief technology officer for the UK's National Cyber Security Centre (NCSC), says the "scale of this is unprecedented".

"It will be universally felt, I suspect," he tells BBC Radio 4's World At One.

On the possibility this flaw has been used by hackers, he says there are "no indications" at the moment of "any successful breaches".

Without being drawn into specific organisations, he says the NCSC is "starting to see positive confirmation" that advice sent to those affected has been received and is being acted on.

When asked if there will be more events like this, he says it is "reasonable to expect that this will not be the last".

Speaking in the House of Lords, technology minister Baroness Lloyd of Effra says the National Cyber Security Centre was "briefed by OpenAI last week on this potential specific vulnerability".

That warning prompted efforts by the government "to ensure that disclosure happened in a coordinated way with vendors so that there was sufficient preparation to protect customers", she says.

As a reminder, the PHP Foundation's original plan was to release a software patch in late October, but it was forced to bring forward the announcement after a leak.