A critical security vulnerability in PHP has prompted urgent website security measures, with organisations including the BBC reportedly taking websites offline temporarily while addressing the risk.

PHP is one of the technologies used to build and operate websites, including platforms that rely on content-management systems such as WordPress and Drupal. A flaw in widely deployed software can therefore create risks for publishers, businesses and public-sector organisations.

Reports published on 22 October said the vulnerability raised concerns that attackers could exploit affected systems remotely. The UK’s National Cyber Security Centre reportedly advised organisations to apply mitigations urgently or temporarily take affected services offline if they could not secure them quickly.

A patched PHP release has been made available, according to reports, but organisations still need to check which versions they use and whether their systems have been updated correctly.

The incident highlights the importance of rapid security patching, vulnerability monitoring and incident-response planning for businesses that depend on online services.

Website operators should follow official PHP security advisories and guidance from the National Cyber Security Centre, verify their software versions and apply the relevant security updates as soon as possible.