A critical security issue in the PHP programming language has led to 32 Government services being taken offline, with four others partially unavailable, as organisations across the UK rush to address the vulnerability.
The flaw, flagged by artificial intelligence, affects a programming language used by many UK organisations. It gave attackers the potential to remotely control any web servers running the widely used PHP software.
Government Response and Warnings
The National Cyber Security Centre (NCSC) has urged organisations to update to a new, fixed version of the software. If an immediate upgrade is not possible, the NCSC advised organisations to consider taking their websites offline.
A Government spokesperson said: “Work is already under way across Government to actively identify and patch any potential exposure. We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”
Impact on Services
At around midday on Thursday, a minister in the House of Lords confirmed that 32 Government services are offline and four are partially unavailable amid the PHP cyber security issue. While there is no specification on which services are included, it is thought that no large UK public-facing critical services will be affected.
The Office for Budget Responsibility (OBR) said it had followed guidance to take its website offline, and it is understood some of the Government’s online services may be temporarily unavailable while steps are taken to maintain security.
MOT Testing and Budget Security
MOT testing services suffered an outage relating to the PHP cyber incident. The DVSA system, through which garages log their MOT records after testing vehicles, started experiencing issues yesterday afternoon until the issue was resolved this morning, according to the DVSA website. An update on the DVSA website at 11.34am on Thursday said the incident had been resolved.
Major cyber security company Cloudflare's chief executive Matthew Prince warned that there was a dramatic surge in attempts to exploit the issue once it was announced. The security of next week’s Government Budget has not been compromised by the flaw, a minister has said.
