The UK government has confirmed that 32 government services are offline and four are partially unavailable following a critical security issue in the PHP programming language. The disruption has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied.
Critical PHP vulnerability prompts global concern
A researcher using AI discovered a critical security issue in PHP, a programming language used by almost 70% of websites, according to cybersecurity firm Cloudflare. Cloudflare said it saw "millions" of hacking attempts on a range of organisations around the world that use PHP.
The vulnerability could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento. Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudflare.
Government response and precautionary measures
Tech minister Baroness Lloyd of Effra told the House of Lords: "The information I have is that 32 Government services are unavailable and four are partially unavailable." She said that "has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".
A Downing Street spokeswoman said: "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue."
She added: "No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues." The spokeswoman said it was not "standard practice" to provide a list of Government services that were affected.
Guidance issued for organisations
Organisations have been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.
The No 10 spokeswoman said: "Organisations of all sizes should follow NCSC guidance to protect their system." Earlier, a minister said the security of next week’s Budget has not been compromised. It has not been disclosed which services have been affected.
