Topic Lifecycle: Peaking
This topic is currently peaking in attention. Broadcasters dedicated 6332s of airtime to it on Thursday 22 October 2026, up 6.2x from the previous completed appearance.
Coverage trend (last 30 days)
How much coverage this topic got from each channel over the past month.
On screen
Stills are sampled automatically at 60-second intervals. Where shown, the still is the nearest available frame from the relevant broadcast segment and is included to show what was on screen during that part of the broadcast. A still may not correspond to the exact second of a quoted phrase.
Recent stories
The latest story timelines linked to this topic, newest activity first.
What was reported
A plain summary of this topic, built from the channels that covered it.
BBC ONE West and Sky News described major security flaws in PHP, a programming language widely used on websites, and a scramble by organisations to patch them. BBC ONE West reported that governments and organisations around the world had been trying to protect themselves. Websites and pages were taken offline as a precaution in several countries, including the UK, Japan, Belgium, France and the Netherlands, with some BBC pages affected. BBC ONE West reported that the outages were intended to prevent an attack rather than caused by one, and that cyber authorities in the UK and US had issued warnings. A fix was being released and organisations were racing to apply it. Sky News reported that the previous day had seen websites across the internet go offline as organisations scrambled to patch the flaw, and that exploitation attempts began soon after it became public. It reported warnings that AI is already helping hackers exploit vulnerabilities faster, while also noting that AI tools had been used to identify the flaw. Sky News cited the Cloudflare CEO as saying attempted exploitation rose from thousands before the public announcement to millions afterwards, and Amazon Web Services as warning that AI would sharply shorten the time before vulnerabilities are exploited. BBC ONE West reported that an anonymous hacker clip circulated on social media and gave clues about how the PHP vulnerability could be exploited, prompting concern that criminals might attack before sites were protected. Sky News cited NetBlocks director Alp Toker as saying that long-standing and neglected systems could lead to a wider and long-lasting wave of attacks.
Key Claims by Channel
Wednesday 21 October 2026
| Claim |  |  |  |  |  |  |
|---|---|---|---|---|---|---|
| Widely reported · 5 or more of 6 channels | ||||||
| The PHP vulnerability was reportedly discovered using AI by Wiz and independently by OpenAI. | Reported by Channel 5 | Not reported by BBC One | Reported by Channel 4 | Reported by ITV | ||
| Reported by a few · 2–4 channels | ||||||
| Finnish and Dutch government agencies reportedly took websites down. | Not reported by Channel 5 | Not reported by BBC One | Not reported by Channel 4 | |||
| PHP is reportedly built into up to about 70% of the world's web pages. | Not reported by Channel 5 | Not reported by BBC News | Reported by Channel 4 | Reported by ITV | ||
| PHP developers issued updates to fix critical vulnerabilities in the PHP web server programming language. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Reported by Sky News | |
| The UK National Cyber Security Centre and other cybersecurity agencies advised organisations to patch the vulnerability or consider taking sites down as a precaution if they could not do so quickly. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Reported by Sky News | |
| Cloudflare's CEO said attempted exploitation rose from thousands in the 10 hours before the public announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the time of his post. | Reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
| Only on one channel | ||||||
| The takedowns were not caused by a hack but by a vulnerability discovered by cybersecurity companies and communicated by national cyber security agencies. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Core UK government websites and the NHS do not run on PHP directly, though some peripheral systems may need the patch. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Without a fix, hackers could potentially exploit the flaws to run malicious code remotely. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Reported by ITV | Not reported by Sky News |
| The flaws had gone undetected for more than a decade and attackers were already trying to exploit them. | Not reported by Channel 5 | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| Edinburgh Council was among the organisations whose websites were taken offline. | Not reported by Channel 5 | Not reported by BBC News | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| Attackers used AI to reverse engineer the exploit and target unpatched websites. | Not reported by Channel 5 | Not reported by BBC News | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| Outages affected UK government services and parts of Amazon and Wikipedia. | Reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
Thursday 22 October 2026
| Claim | | | | | | |
|---|---|---|---|---|---|---|
| Reported by a few · 2–4 channels | ||||||
| PHP is reportedly built into up to about 70% of the world's web pages. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Reported by ITV | Reported by Sky News | |
| The PHP vulnerability was reportedly discovered using AI by Wiz and independently by OpenAI. | Not reported by BBC News | Reported by BBC One | Not reported by ITV | Reported by Sky News | ||
| Governments in Finland, France and Australia and Edinburgh Council were among public bodies that took websites offline. | Not reported by Channel 5 | Not reported by BBC News | Reported by BBC One | Not reported by Channel 4 | Reported by ITV | Not reported by Sky News |
| Attackers could exploit unpatched PHP sites, including by running commands or using their own AI tools. | Not reported by Channel 5 | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| A hacker video circulated online with guidance on exploiting PHP. | Not reported by Channel 5 | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
| Serious vulnerabilities were reported in PHP, a programming language used by many websites. | Not reported by Channel 5 | Not reported by BBC News | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Websites and pages were taken offline as a precaution while organisations patched the vulnerabilities, with outages reported in several countries including the UK and some BBC pages; the outages were not caused by a cyber attack. | Not reported by Channel 5 | Not reported by BBC News | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Cloudflare's CEO said attempted exploitation rose from thousands in the 10 hours before the public announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions by the time of his post. | Not reported by BBC News | Not reported by BBC One | Not reported by ITV | Reported by Sky News | ||
| Only on one channel | ||||||
| The UK National Cyber Security Centre and other cybersecurity agencies advised organisations to patch the vulnerability or consider taking sites down as a precaution if they could not do so quickly. | Not reported by Channel 5 | Reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
| Core UK government websites and the NHS were reported not to rely on PHP. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Many apps from the Pokémon Company could not be accessed. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Reported by ITV | Not reported by Sky News |
| UK and US cyber authorities warned about the potential impact of the PHP vulnerabilities. | Not reported by Channel 5 | Not reported by BBC News | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
| If the vulnerabilities were not fixed, attackers could run commands on servers and potentially access sensitive data such as medical records. | Not reported by Channel 5 | Not reported by BBC News | Reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News |
| Warnings said AI was already helping hackers exploit online vulnerabilities faster than before, and Amazon Web Services warned it would sharply reduce the time before vulnerabilities are exploited. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| NetBlocks director Alp Toker warned that legacy and neglected systems could lead to a wider wave of attacks and a prolonged series of attacks over months and years. | Not reported by Channel 5 | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Reported by Sky News |
| Outages affected UK government services and parts of Amazon and Wikipedia. | Not reported by BBC News | Not reported by BBC One | Not reported by Channel 4 | Not reported by ITV | Not reported by Sky News | |
This is a cross-channel consensus summary, not an objective account. Consensus can be uniformly wrong, or omit what only one channel covered.
Flagged quotes
Disputed or loaded quotes across this topic's coverage, newest first.
Verbatim quotes flagged as contested or rhetorically charged. Presence here reflects language used, not a judgement of accuracy.
- contested
… flaw but some are arguing this is a positive moment. Well this is extremely serious, but fortunately it's a good news story. This vulnerability, as we say in the jargon, has been …
- contested
… to take control of these websites remotely without logging in. So as these things go, this is a bad one. A combination of a very widely used programming language that's …
- charged
… keep coming as more and more websites are taken offline The cyber emergency has led to a public response that is unprecedented But taking sites offline has also led to countless stories …
- charged
… data without having to log in or compromise anyone's password. Security researchers say the programme floor is a gift to cyber criminals. What it means is that someone on the other side …
- charged
… the firm who helped find the fault though Said that this is one of the most serious vulnerabilities. They've ever found we actually spoke to them earlier today We know that …
- charged
… a website, bring it down, plant malicious software, extract data. So it is pretty much a worst case scenario situation for lots of organizations out there. And that's why people are scrambling because if you can't …
- charged
… just don't know, but this is the situation we're in. We're in this desperate race between attackers and defenders as technological conditions are just suddenly changing all under our …
- charged
… are things that are made much easier by AI anyway. I find most scary in this scenario, the fact that you and I, normal internet users, can't …
- charged
… Indeed, OK, Sam, thank you very much indeed for that. Well, with the cyber world in turmoil over this latest emergency, there was this evening a seemingly timely warning from the …
- charged
… if you run a web server or your organization does, this is an absolutely critical vulnerability. You need to get this patched. And there is also …
Timeline
Where this topic appeared. Cells show coverage time and are darker when there was more coverage.
| Date | Channel 5 | BBC News | BBC One | BBC Two | Channel 4 | GB News | ITV | Sky News |
|---|---|---|---|---|---|---|---|---|
| Thursday 22 October 2026 | 2m 27s 6.6% | 23m 37s 20.5% | 16m 25s 10.0% | — | 11m 45s 24.6% | 13m 20s 21.6% | 12m 37s 14.4% | 25m 21s 27.5% |
| Wednesday 21 October 2026 | — | 3m 24s 3.0% | 1m 55s 1.9% | — | — | — | 1m 53s 1.6% | 9m 50s 9.4% |
| Tuesday 13 October 2026 | — | — | — | — | — | — | 1m 40s 2.2% | — |