We've heard more from Baroness Lloyd of Effra, who has given further details about how the UK government's response is playing out.

"The government acted proactively ahead of public disclosure," she says in the House of Lords.

Departments were "alerted to the vulnerability and advised to identify potential affected systems, assess their exposure, and prepare to implement mitigations and security updates".

She reveals that the National Cyber Security Centre was "able to make 50,000 proactive notifications to the wider economy to advise business and other organisations on what actions they should take".

The baroness adds: "The government continues to monitor the situation closely and work with departments to maintain the security resilience and availability of public services."

Image source, House of Lords

More now from Baroness Lloyd of Effra, who is speaking in the House of Lords about the ongoing cyber-security issue. She is the parliamentary under-secretary of state for the Department for Digital, Culture, Media and Sport.

She says the number of government services that are unavailable has "largely resulted" from precautionary measures taken to protect systems while updates and mitigations are applied.

They are working closely with departments to "restore the services safely and securely", she adds.

The advice is to mitigate then restore the services, which they are doing as quickly as possible, the minister adds.

Thirty-two government services are unavailable and four are partially unavailable amid the PHP cyber security issue, Baroness Lloyd of Effra has said in the House of Lords.

We can bring you more now from a No 10 spokeswoman, who has provided a statement on disruption to some services due to the PHP issue.

No large UK public-facing critical services have been affected, the spokeswoman says.

She tells reporters work has already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue".

"But this does not mean they were hacked, and work continues to resolve any issues."

The spokeswoman adds that it is not "standard practice" to provide a list of government services that are affected.

Downing Street says that "some" limited government services "may be offline" while security work is being carried out.

It does not specify which services are included, but says that no large UK public-facing critical services will be affected.

No 10 adds that work has already taken place to identify and fix potential exposures to its systems and its experts are working closely with OpenAI and international partners.

Freya Scott-Turner
Live reporter

Image source, Reuters

Websites around the world have been taken down as companies, organisations and governments work to fix a critical security flaw in something called PHP.

Here's a round-up of what's been happening:

• First up, what is PHP? It's a programming language that underpins a vast number of websites. It essentially collects information and presents it in a way that you can read on the web - we have more on that here
• The flaw is not new: Researchers have been developing a patch - downloadable code to fix the problem - since the flaw was discovered using AI earlier this year. But the flaw's existence was leaked, so the patch is being rushed out to prevent widespread hacking - check out our full timeline
• 'Millions' of hacking attempts: The boss of internet infrastructure company Cloudflare warns they've seen "millions" of attempts to exploit the flaw after the leak
• The researcher who found the flaw: Ryan Austin of cyber-security firm Calif tells the BBC it's the "most serious vulnerability" he's ever found, but says there's no evidence so far to suggest hackers have successfully exploited it

• Digital havoc: "Roughly 70%" of the internet has been affected, says cyber-security firm Wiz. An expert tells us this could impact as many as 30 million websites - we've looked at some of the websites here
• The fact that researchers used frontier AI models to discover as yet hidden flaws should have been a good news story.... then it all went wrong, writes our cyber correspondent Joe Tidy

PHP story feels like the cyber equivalent of an unexploded bombpublished at 11:57 BST 22 October

11:57 BST 22 October

Zoe Kleinman
Technology and AI editor

The PHP story feels like the cyber equivalent of an unexploded bomb - I have never seen such a dramatic, public and global response to a cyber event that hasn't happened yet.

There has been no painful attack like the ransomware we saw knock out M&S and JLR in 2025.

But the potential threat is so serious that websites around the world have been taken down as a precaution.

Less than two months ago, 100 tech companies wrote an open letter warning the world to adopt a new level of cyber resilience in the age of AI.

It turns out we didn't have to wait very long to find out what they meant.

The weaknesses found in the PHP programming language, which is used by millions of websites, had been quietly resting there for years and are not easy to exploit.

The tech is getting a lot of credit here for assisting researchers in finding the bugs, and the PHP foundation, which oversees the programming language, was on the case and issued a fix.

Rozina Sini
BBC News

Dean Presley, who has a garage in Chepstow, South Wales, tells us he’s been unable to properly process MOTs online.

He says his MOT computer system has been down since Wednesday morning, and while it has experienced outages before, they never last this long.

"MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," Dean says.

This is forcing him to write everything on paper documents, leading to delays for customers, he adds.

"It’s a bit of a pain," he tells us, "but customers seem to understand".

Dean's garage is unlikely to be the only one experiencing issues, as the DVSA's MOT website had been reporting an outage since around midday on Wednesday.

It didn't explicitly mention the PHP issue - the site just reported a "problem with the MOT testing service".

A separate update a few minutes ago says the incident has now been resolved.

The AI minister Kanishka Narayan has revealed the government found 500 new vulnerabilities in "significant areas of the public sector" after paying £13,000 to use an AI model to look into potential problems.

On tomorrow's episode of Political Thinking, recorded before the PHP flaw emerged publicly, Narayan told Nick Robinson hundreds of "novel vulnerabilities" were discovered in "significant areas of the public sector".

You can find the full episode of Political Thinking with Nick Robinson on BBC Sounds from tomorrow.

Shiona McCallum
Senior technology reporter

Small businesses with websites, including those built using WordPress, may be wondering how to protect themselves.

Ethical hacker Ken Munro, who has spent years finding security flaws in computer systems, says installing the fixes - known as patching - is "a bit like running a Windows update".

If a hosting company or web developer manages your website, contact them and ask whether the PHP security fixes have been applied. They may already have done this, but it is important to check.

The fixes need to be applied to the PHP itself as updating WordPress or its plugins alone will not resolve the problem.

If you look after your website yourself, he says "it is your own responsibility to make sure fixes are applied".

If your website cannot be secured promptly, you could consider discussing temporarily taking it offline with your hosting company or web developer.

The UK’s National Cyber Security Centre recommends considering this where updates or temporary protections cannot be applied quickly enough.

Cyber-security lecturer Rory Hopcraft says the government needs to make sure its infrastructure is up to date, and ensure it is employing the tools and practices it should already be using and following.

"Hacking has been around for many years," he says, adding that incidents are just happening with more speed and persistency now.

"The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point," he says.

Cyber correspondent Joe Tidy says the message to everybody is "really clear".

"If you use PHP in your stack, you need to look at it, you need to fix it", and if you can't, you need to take it offline, he says.

Whether or not people are listening to that message "remains to be seen", he says, explaining there is often a "lag between public acknowledgment of a problem and IT teams taking measures they need to".

"Generally speaking, the harm to individuals isn't that bad," says cyber correspondent Joe Tidy, who notes that banking systems and other organisations already have protections in place.

"The real worry would be if we see something that is beyond what we are used to," he says.

"We are sadly used to ransomware attacks and extortion attacks, and our data is being stolen all the time," he explains.

"These kind of things do happen and we get on with it."

Rory Hopcraft, a cyber-security lecturer at the University of Plymouth, says the patch was available yesterday evening UK time, meaning we're already seeing services returning.

When asked about the role of AI, he says "it's a positive thing that we're seeing these tools used for good, it can help us understand the vulnerabilities".

Joe Tidy compares the PHP flaw with a previous cyber-security issue in 2021, when it took 15 days for cyber criminals to begin carrying out malicious intent, he says.

"Now we have AI, the criminals have taken half a day to come up with something usable," Tidy says.

Cyber correspondent Joe Tidy says he didn't know PHP existed until yesterday morning - it's "one of these things we take for granted", he says.

But those in the cybercrime world will "jump on a vulnerability like this because it could open up a huge number of possibilities", he says.

Explaining how cyber criminals could exploit the flaw, Tidy says: "If you are able to plant your code on someone else's servers, you can do whatever you want.

"So you can deface a website, bring it down, plant malicious software, extract data."

That is "pretty much a worst-case scenario situation for a lot of organisations out there", he explains.

This creates a race against time, with organisations who are unable to patch their sites quickly then needing to take them offline while they figure out what to do, Tidy adds.

PHP is "part of the invisible infrastructure [of the internet] that we all take for granted", says BBC cyber correspondent Joe Tidy, who notes that it potentially runs up to 70% of websites.

Tidy notes that this problem dates back to 2024, when researchers of PHP had a "potential worry about a theoretical flaw but... couldn't work out how it was possible to actually conduct an attack ".

Then artificial intelligence (AI) came along, Tidy explains, as well as an OpenAI project which uses AI to find vulnerabilities and fix them.

Researchers found "two brand new very serious flaws" with PHP and came up with a plan to fix them, he says.

"It was all going to be very civilised" but then someone leaked the details of this flaw, which has "started a frenzy in the cybercrime world" as people on the internet try to exploit the flaw, says Tidy.

How could PHP flaws affect me? What even is PHP?

The BBC has gathered experts who will be answering your questions about the scramble to fix critical security issues identified in the programming language that underpins much of the internet.

Joining us from 10:30 BST will be cyber correspondent Joe Tidy and cyber-security lecturer Dr Rory Hopcraft, of the University of Plymouth.

We'll bring you all the key lines here and you can watch live at the top of the page.

Liv McMahon
Technology reporter

We’ve seen a lot of sites go offline as a precaution or to patch the PHP vulnerabilities flagged yesterday.

At the moment, we do not know whether any hackers have successfully exploited the flaws which surfaced in the widely used programming language.

Experts warn it could allow attackers to remotely run malicious code on affected web servers or steal data.

But some large organisations have said they’ve seen a high volume of attempts to breach their systems.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X earlier that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now," he says.

Amazon also says it saw hackers attempt to exploit the flaws, but so far its websites are operating as normal.

No sign of any widespread hacking - yetpublished at 09:54 BST 22 October

09:54 BST 22 October

Joe Tidy
Cyber correspondent

Internet giants Cloudflare and Amazon are both reporting that millions of hacking attempts are being made by cyber criminals already as the PHP vulnerability is actively being used "in the wild".

These kinds of numbers are alarming but in cyber security there is a big difference between attempts to hack and successful breaches.

It’s important to understand the language that cyber security teams use. A lot of the hacking attempts are likely to be automated scans. Hackers press a few buttons to scan the internet for websites that might be vulnerable.

There are also probably a fair few 'good guys' scanning websites too as part of the emergency response taking place caught up in those figures.

There is no suggestion yet that any major corporations or organisations have been hacked using the PHP flaws.

Even if a website is hacked using PHP, it will likely be a slow and silent process where hackers plant malicious software to compromise patiently.

At the moment there is nothing us consumers can do as the pressure is on companies and institutions to work to protect themselves - and us.

Tom Gerken
Tech reporter

Image source, Reuters

At the moment, most people are going to notice something is amiss when they try and access certain websites.

Bear in mind lots of them are back up already - Wikipedia, for example, is fully operational again, having experienced “emergency maintenance” yesterday.

But the real question is what happens if some websites fail to fix things. At that point, it all becomes a bit unclear. The PHP Foundation calls the flaws "critical vulnerabilities".

There’s no question about how serious they are. Theoretically, a motivated hacker could gain access to the data on a website - which could expose customer details.

At that point, it could suddenly start to have a real impact on people if hackers gain access to their details.

That’s all a bit speculative, of course. But things like this don’t happen unless the threat is serious.

Along with many other affected websites, several BBC webpages are down this morning.

This includes several programme websites on BBC One - including the official site for The Traitors and Eastenders - as well as programme websites across BBC Two and BBC Three.

When you try accessing these websites a message appears on screen saying "this service is temporarily unavailable".

We have asked the BBC Press Office if the PHP flaw is the reason for the webpages not running.