23rd October 2026
Website owners are being urged to check their security as warnings over serious PHP software vulnerabilities raise questions about how many sites remain exposed to attack.
The recent PHP security scare has prompted some organisations to take websites offline or restrict access while they investigate the risks. Others have continued operating, raising an important question: are hackers still attacking websites, and what happens to those that have yet to apply the necessary fixes?
The concern is not simply theoretical. Security researchers have reported attempts to exploit the vulnerabilities, making this a genuine cybersecurity issue rather than just a precautionary exercise.
PHP is a programming language used extensively to run websites and their underlying applications. It is particularly common in content management systems and other software that allows organisations to publish news, manage information and provide online services.
Because PHP is so widely used, a serious flaw can have consequences across a large number of websites. The danger depends on the particular software and configuration involved, but some vulnerabilities can allow an attacker to execute malicious code on a server.
Why have some websites been taken offline?
Taking a website offline, or temporarily restricting access, can be a reasonable precaution when its operator cannot immediately establish whether the system is safe.
For a council, health service or large business, an infected website could create more than an inconvenience. It might expose information, provide an entry point into other computer systems or allow criminals to alter pages and distribute malicious content.
A website being taken offline does not mean that it has been hacked. It may simply indicate that its owner is taking the threat seriously while technical checks and updates are carried out.
Likewise, a website that remains accessible is not necessarily vulnerable. Its operator may already have installed the relevant security fixes or applied another effective mitigation.
The difficulty for the public is that there is usually no visible indication of which situation applies.
Are hackers still attacking websites?
Security reporting has indicated that attempts to exploit the PHP flaws have been observed. Once details of a vulnerability become public, criminal groups and automated scanning systems can search for internet-facing servers that have not been properly protected.
Such activity does not necessarily involve a hacker selecting an individual organisation. Automated tools can search large numbers of systems and attempt to exploit any that appear vulnerable.
That makes the period following the disclosure of a serious software flaw particularly important. Some website operators can install an update quickly, while others depend on hosting companies, external developers or older systems that are more difficult to maintain.
There is a crucial distinction between evidence of attempted attacks and evidence that those attacks have succeeded. Public reports of exploitation attempts demonstrate that the threat is real, but they do not establish how many websites have been compromised in Britain, Scotland or the Highlands.
Nor can the fact that a website is still operating tell us whether it has been attacked.
The problem for smaller organisations
Large organisations often have dedicated IT and cybersecurity teams. Smaller businesses, community groups and local publishers may rely on a website developer or hosting provider to keep their systems secure.
Some owners may not even know which version of PHP their website uses. Others may assume that paying for website hosting means every aspect of security is automatically covered.
That assumption can be dangerous. Hosting providers differ in the services they supply, and responsibility for updating the server, website software, themes and plugins may be divided between several parties.
Older software can present a particular challenge. Where a PHP version is no longer supported, an upgrade may be necessary, although some hosting and operating-system providers supply security fixes for older versions through their own maintenance arrangements.
The important question is not simply whether a website uses PHP. It is whether the particular installation is affected and whether the necessary protection has been applied.
What should website owners do?
The first step is to contact the hosting provider or technical administrator and establish whether the server is affected by the reported vulnerabilities.
Owners should ask whether the relevant security fixes have been installed, whether any additional software requires updating and whether the system has been checked for signs of compromise.
Installing a patch is essential where required, but it may not be sufficient if an attacker has already gained access and installed malicious software. Appropriate checks should therefore form part of the response.
Organisations that discover evidence of a breach should seek specialist assistance rather than assuming that updating the software has solved every problem.
For members of the public, there is no need to panic simply because a familiar website is still online. However, it remains sensible to be cautious about unexpected links, suspicious downloads and requests for personal information.
A warning that should not be ignored
The PHP scare highlights a wider problem facing organisations that depend on websites to deliver everyday services. Software vulnerabilities are inevitable, but the speed and quality of the response can determine whether a technical flaw becomes a serious incident.
Taking a website offline may be inconvenient, particularly when it provides essential public information. Yet continuing to operate an exposed system without adequate protection could be considerably more damaging.
The challenge now is to establish that vulnerable systems have been fixed and that any evidence of earlier compromise has been investigated.
For the moment, the evidence of exploitation attempts is sufficient to justify urgent action by affected website operators. What remains unclear is the scale of successful attacks and how many organisations are still exposed.
A website that looks normal to its visitors may be secure, or it may have a problem that is invisible from the outside. The only responsible way to know is to check.