Organisations and businesses are scrambling to update their systems after critical security flaws were discovered in PHP, one of the world's most widely used web programming languages.

Websites around the world were taken offline on Wednesday and Thursday after PHP's developers confirmed "critical vulnerabilities" in the back-end language, which has been used in web development for decades.

Researchers warned the "severe" flaws could expose millions of sites to potential hacks if left unpatched. The UK government was among those to take services offline as a precaution.

No successful attacks have been reported so far, but experts cautioned that any impact may take time — even months — to become fully apparent.

Downing Street said on Thursday that "some" limited government services "may be offline" while security work was being carried out.

"The information I have is that 32 Government services are unavailable and four are partially unavailable," tech minister Baroness Lloyd of Effra told the House of Lords.

She said the disruption had "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied."

The government did not specify which services were taken offline, but said no large UK public-facing critical services had been affected.

A government spokesperson said work had already taken place to "identify and fix potential exposures to our systems," adding that experts were "continuing to work closely with both OpenAI and international partners on this issue."

"But this does not mean they were hacked, and work continues to resolve any issues," the spokesperson added.

Olly Whitehouse, chief technology officer of the National Cyber Security Centre, called the event "unprecedented."

"It will be universally felt, I suspect," he said. He added there were "no indications" of any successful breaches by hackers, and that the NCSC was "starting to see positive confirmation" that advice sent to those affected had been received and was being acted on.

Cyber-security lecturer Rory Hopcraft said the government needed to ensure its own infrastructure was up to date.

"Hacking has been around for many years," he said. "The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point."

The disruption has also affected small businesses. Dean Presley, who runs a garage in Chepstow, South Wales, said he had been unable to properly process vehicle MOTs online since Wednesday morning.

"MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," he said. The outage has forced him to record everything on paper, causing delays for customers.

PHP, which stands for PHP: Hypertext Preprocessor, is a programming language that runs on web servers and powers the dynamic content users see when visiting websites. Developed in the early 1990s, it remains in widespread use today across platforms including Wikipedia, WordPress, and numerous online shops, as well as popular development frameworks such as Laravel, Symfony, and Drupal.

According to cyber-security firm Wiz, which helped uncover the vulnerabilities, PHP powers approximately 70% of the world's websites. The flaws — now referred to as "php2shell" — are described as inherent in the language itself, affecting many past versions.

The PHP Foundation, the non-profit that maintains the language, warned that under the right conditions an unauthenticated attacker could remotely execute code on servers running PHP.

Large organisations reported a high volume of attempted breaches. Matthew Prince, chief executive of internet infrastructure firm Cloudflare, wrote on X that his company recorded "thousands" of attempts to exploit the vulnerabilities in the ten hours before the flaws were publicly announced.

"That jumped to tens of thousands in the 45 minutes post announcement," Prince wrote.