What is PHP and why did it spark a global cyber-security scramble?

This video can not be played How did AI discover the internet's massive cyber-security risk? For more than a decade, serious flaws had gone undetected in the technology underpinning much of the internet. It took AI to bring them to light and caused a global cyber-security alert. Researchers who helped surface the vulnerabilities in PHP - a popular server-side programming language used in web development for decades - warned platforms which use it could be exposed to potential hacks. Governments and cyber-security agencies rushed to contain the fallout, urging website owners to check if their sites were affected and, if so, install updates to patch the issue or consider going offline. There have been no reports of any successful exploits of the flaw, coined php2shell, so far. But in the days since the issues came to light, disruption to sites and services has continued to ripple around the world. Most people may not have heard of PHP, but they probably interact with it daily. It stands for PHP: Hypertext Preprocessor, an open-source, back-end programming language which runs on a web server. Developed in the early 1990s to help serve dynamic web pages and applications, PHP still powers lots of platforms today, including Wikipedia, online shops and WordPress – the system behind many websites. When you visit a site, PHP is the code which collects data and effectively turns it into a page you can read. It has also been used to write a number of tools for building or speeding up the creation of web apps, with Laravel, Symfony and Drupal among popular PHP frameworks. According to cyber-security firm Wiz, which helped uncover the critical PHP vulnerabilities surfaced this week, PHP powers 70% of the world's websites. It is maintained by a non-profit called the PHP Foundation, external, composed of individuals and companies which depend on the language and aim to ensure its "long-term prosperity". A group of cyber-security researchers and organisations disclosed two vulnerabilities within PHP this week, which they warned could have the potential to upend sites across the internet. Cyber firms Wiz and Calif said the flaws were inherent in the language itself, affecting versions of PHP released over the last decade. The technical bugs, given the technical IDs CVE-2026-109618 and CVE-2026-109619, were ranked a 9.2 out of 10 in severity by researchers. Calif researcher Ryan Austin, who helped uncover it, told the BBC it was "the most serious vulnerability I've ever found".