Thirty-two UK Government services have been taken offline and four are experiencing partial disruption while efforts continue to tackle potential cybersecurity threats, a minister has confirmed. Organisations worldwide have been racing to rectify a serious security vulnerability in PHP, the programming language powering the vast majority of websites.
Government Services Suspended as Precaution
Downing Street stated on Thursday that no major UK public-facing critical services have been impacted, though some "limited" Government websites have been temporarily suspended while the issues are being resolved. Experts from the National Cyber Security Centre (NCSC) are collaborating with OpenAI, whose technology helped identify the vulnerabilities, alongside international partners to address the potential risks, a No 10 spokeswoman confirmed.
Tech minister Baroness Lloyd of Effra informed the House of Lords: "The information I have is that 32 Government services are unavailable and four are partially unavailable." She explained that "has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".
NCSC and OpenAI Collaborate on Fixes
The Downing Street spokeswoman briefed journalists: "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue. No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues." The spokeswoman indicated it was not "standard practice" to disclose which Government services had been impacted.
This follows cybersecurity experts alerting UK organisations on Wednesday to a "critical security issue" identified in PHP, software utilised by nearly 70% of websites according to cybersecurity firm Cloudflare. Lady Lloyd revealed the NCSC received a briefing from OpenAI regarding the vulnerability "last week" and "the Government acted proactively ahead of public disclosure".
Budget Security Unaffected
The NCSC has urged organisations to upgrade to the latest, patched version of PHP software – or contemplate temporarily shutting down their websites if immediate updates prove impossible. The No 10 spokeswoman added: "Organisations of all sizes should follow NCSC guidance to protect their system."
Meanwhile, a minister has insisted next week's Budget remains secure. Scottish Secretary Douglas Alexander was questioned whether the PHP vulnerabilities could trigger significant Budget leaks, given the Office for Budget Responsibility (OBR) was forced to suspend its website. Mr Alexander told Times Radio on Thursday morning: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security. Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer."
Last year, the OBR's budget analysis was accidentally posted online ahead of then-chancellor Rachel Reeves's address to the Commons, providing premature access to market-sensitive data. The PHP security flaw that was uncovered could enable hackers to remotely commandeer web servers operating on PHP, which powers widely-used platforms including WordPress and Magento. Numerous attempts to exploit the vulnerability were detected within hours of it being made public, according to both Amazon and Cloudflare. In a statement posted on the Amazon Web Services security blog, the tech giant revealed its threat intelligence team had established that the flaw was "now being broadly exploited in the wild".
