Critical security flaws in PHP have prompted an urgent international effort to update computer systems, with warnings that attackers could seize control of vulnerable website servers and compromise sensitive information. The UK is assessing its exposure, while councils and NHS boards in Scotland have taken websites offline following a security alert. The FBI’s cyber threat division has also warned of risks to websites, applications and networks.

Cyber-security company Wiz estimates that roughly 70% of the internet is affected, although the available information does not independently verify that figure. Separately, Voldemaras Kadys, head of security at Mediatech, said two critical flaws had been discovered in PHP, which he described as supporting most websites. The estimate points to potentially extensive exposure, but it should not be read as a count of successful attacks, compromised servers or stolen customer records. Those are distinct measures, and the available information does not establish their scale.

Kadys outlined several possible consequences of attackers gaining control of vulnerable website servers. They could steal customer information, alter website content, install malicious software or make a website unavailable, he said in a statement. His warning places both data security and the continued operation of online services at issue. The potential damage is therefore not limited to what visitors see on a page: the server behind it, and the information it holds, could also be at risk.

Read more: Microsoft links ConnectWise breach to intrusions at around 2,250 organisations

The FBI’s cyber threat division acknowledged the vulnerabilities in a public post and said cybercriminals could interfere with websites and applications by remotely inserting malware into PHP’s source code. It warned that sensitive data and networks could consequently be compromised. That assessment reinforces the concern about malicious interference, but it is a warning about what the weaknesses could permit, rather than a quantified account of exploitation. No number of successful intrusions is established by the information available.

Woodward also warned that the consequences could extend beyond an initially exposed system. Attackers could steal data, move into other parts of a network or leave a backdoor allowing them to return later, Woodward said. That possibility gives the alert a broader significance than the immediate availability of a website. A page remaining accessible would not, by itself, answer the separate concern raised in that warning: whether an attacker could gain access to information or other network resources.

The UK response includes work to identify exposure following the global security warning. In Scotland, councils and NHS boards have already removed websites from public access after the alert. Those actions show that the response is affecting public-facing services, not only technical work behind the scenes. They do not, however, establish that the organisations concerned suffered an intrusion. Taking a website offline following a warning and confirming that attackers have compromised it are different developments and should not be treated as equivalent.

Read more: Russian strikes kill 7 in Ukraine amid push to resume peace talks

An AI minister has separately said that 500 new vulnerabilities were found in government. The available information does not establish how that figure relates to the PHP flaws, so it cannot be used as a tally of government systems affected by this alert. It nevertheless forms part of the wider discussion about government exposure to software weaknesses. Keeping the figures separate is important: a count of vulnerabilities and an estimate of the share of the internet affected describe different things.

The response brings a practical tension into focus. Kadys’s warning includes the possibility that attackers could force websites offline, while the Scottish response shows organisations themselves withdrawing access after a security alert. From a user’s perspective, either can mean an unavailable website, but the causes are different. The available information does not provide a timetable for restoring those sites or establish whether the same response is necessary elsewhere. It therefore offers no basis for treating withdrawal of access as a universal requirement.

The strongest common ground in the warnings is the seriousness of the possible consequences, rather than a verified measurement of worldwide exposure. Kadys, the FBI division and Woodward each describe ways an intrusion could threaten information or systems. Wiz supplies a broad estimate of reach, but the absence of independent verification in the available information limits the conclusions that can be drawn from it. The distinction matters for an international response: a large estimate conveys potential scale without identifying which individual websites or applications are vulnerable.

The immediate focus remains on updating systems and determining where exposure exists. The UK’s assessment and the removal of Scottish public-sector websites illustrate different parts of that response, while the FBI warning underlines the international concern. Further information would be needed to establish the extent of actual exploitation, which organisations have been compromised and the progress of patching. Until then, the central finding is narrower than the headline estimate: critical PHP weaknesses have triggered urgent action, with potentially serious consequences for vulnerable servers, data and networks.