Scotland Secretary Douglas Alexander has said there is no indication that the security of next week's Government Budget has been compromised by a critical security flaw in the PHP programming language, which is used by a majority of websites.
Alexander was asked whether the issues identified with PHP could lead to major Budget leaks, after the Office for Budget Responsibility (OBR) had to take down its website.
Minister's assurance
Speaking to Times Radio on Thursday morning, Alexander said: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security."
He added that John Healey, who he was with yesterday in Scotland, had initiated new security protocols reflecting his experience at the Ministry of Defence when he came to the Treasury as Chancellor in the summer.
Last year, the OBR's Budget analysis was mistakenly published online ahead of then-Chancellor Rachel Reeves' statement to the Commons, allowing early access to market-sensitive information.
Critical vulnerability in PHP
Cyber security chiefs warned UK organisations on Wednesday that a "critical security issue" had been discovered in PHP, which is used by almost 70% of websites, according to cybersecurity firm Cloudflare.
The National Cyber Security Centre (NCSC) has urged organisations to update to a new, fixed version of the PHP software, or consider taking their websites offline if they cannot be upgraded immediately.
The security issue could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.
Exploitation attempts
Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudflare.
In an update on the Amazon Web Services' security blog, the company said its Threat Intelligence team found the flaw was "now being broadly exploited in the wild".
Cloudflare CEO Matthew Prince said on Thursday that the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.
In a post on X, Prince said: "In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Patch released early
PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.
Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), told BBC Radio 4's Today programme: "The cat was let out of the bag rather earlier than it was supposed to have been. There was an embargo on this, and there's always a window between the flaw being publicly known about and it being patched so that the attackers can't successfully get in. And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag."
Woodward added that an initial version of the patch was released, making it easy to compare the original with the patched version and see which part of the code to exploit. He noted that companies like Amazon and Cloudflare saw that the flaw was being probed for.
The Wall Street Journal previously reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.
Woodward explained that the vulnerability had been identified by human researchers back in 2024, but it was then believed exploiting it would be "too complicated," and nothing was done. He said that as large language models became more effective at analysing such issues, people worked out how to exploit it.
Woodward said: "The patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that's why everybody's scrambling to make sure that that's in place."
