Thirty-two Government services offline amid PHP cybersecurity issue

Thirty-two Government services offline amid PHP cybersecurity issue No 10 said no large UK public-facing critical services have been affected, but some ‘limited’ Government websites have temporarily gone dark. - Bookmark Become an Independent member to bookmark this article Already a member? Log in Thirty-two Government services are offline and four are partially unavailable while work is carried out to address potential cybersecurity issues, a minister has said. Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites. Downing Street on Thursday said no large UK public-facing critical services have been affected, but some “limited” Government websites have gone dark while issues are resolved. National Cyber Security Centre (NCSC) experts are working with OpenAI, whose technology was used to discover the vulnerabilities, and partners around the globe to address potential problems, a No 10 spokeswoman said. Tech minister Baroness Lloyd of Effra told the House of Lords: “The information I have is that 32 Government services are unavailable and four are partially unavailable.” She said that “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied”. The Downing Street spokeswoman told reporters: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue. “No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. “But this does not mean they were hacked, and work continues to resolve any issues.” The spokeswoman said it was not “standard practice” to provide a list of Government services that were affected. It came after cybersecurity chiefs warned UK organisations on Wednesday that a “critical security issue” had been discovered in PHP, which is used by almost 70% of websites according cybersecurity firm Cloudflare. Lady Lloyd said the NCSC was briefed by OpenAI on the vulnerability “last week” and “the Government acted proactively ahead of public disclosure”. Organisations have been urged by the NCSC to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately. The No 10 spokeswoman said: “Organisations of all sizes should follow NCSC guidance to protect their system.” Earlier, a minister said the security of next week’s Budget has not been compromised. Scottish Secretary Douglas Alexander was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website. Mr Alexander told Times Radio on Thursday morning: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security. “Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.” Last year, the OBR’s budget analysis was mistakenly published online ahead of then-chancellor Rachel Reeves’s statement to the Commons, allowing for early access to market sensitive information. The PHP security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento. Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare. In an update published on the Amazon Web Services security blog, the company said its threat intelligence team found the flaw was “now being broadly exploited in the wild”. [Image text:] php A pogutar geren e Fast eeie atd prgnatic suhad t wnb Beveiogmer whar'scesines National Cyber ncsc.gov.uk Men NEWS Critical security issue affecting PHP The NcsC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP CVE-2026-109618 and CVE-2026- 109619) Me PuPfaundae