Hacking attempts rise after flaws are found in the PHP language that NPR says runs about 70% of websites
NPR reported on Friday, Oct. 23, that hacking attempts have risen after flaws were found in PHP, a programming language that NPR says runs about 70% of the world’s websites. NPR reported that Wiz Research, using OpenAI technology, reported the flaws and that the PHP Foundation released two patches. NPR reported that OpenAI called the bug one of the most impactful vulnerabilities in recent memory and that Wiz warned exploitation could let attackers take over servers and steal data. NPR reported that the U.S. National Security Agency urged organizations to stay alert over the coming weeks, that Britain’s National Cyber Security Centre told organizations to patch immediately, and that Japan’s prime minister issued an urgent request for action. NPR reported that dozens of British and Finnish government services went offline this week and that many local government sites in France were briefly taken down.
PHP is widely used, so a serious flaw can affect many sites at once, and a patch only helps once site owners install it. That is the reason governments are urging fast updates in NPR’s account.
If you run a website, the reports point to installing the PHP Foundation’s patches promptly. If you only use websites, the practical effect described is possible outages of some government services, not a step you need to take.
The urgent view, from NPR’s account of agencies, is that the flaw is severe and exploitation is rising: the NSA, Britain’s cyber agency and Japan’s prime minister all called for quick action.
The narrower view is that the scale is not quantified: NPR’s headline says hacking attempts rise, but the reports reviewed give no count. On this view, the severity ratings come from the researchers and company that found the flaws.
Confirmed by NPR: flaws in PHP were reported, patches were released and several governments issued warnings. Not confirmed: the size of the rise in attacks or a full list of affected sites. Watch for further patches, government advisories and any more service outages.
DailyDrop U.S. No. 20 · October 24, 2026