Thirty-two UK Government services have been taken offline and four are experiencing partial disruption while authorities work to address potential cyber security threats, a minister has confirmed. The move follows a critical security flaw discovered in PHP, the programming language used by the vast majority of websites worldwide.
Precautionary measures in place
Downing Street said on Thursday that no major public-facing critical services in the UK had been affected, though a number of "limited" Government websites had been temporarily pulled offline while problems are resolved. Tech minister Baroness Lloyd of Effra told the House of Lords: "The information I have is that 32 Government services are unavailable and four are partially unavailable."
She added that this "has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied". Specialists from the National Cyber Security Centre (NCSC) are working alongside OpenAI, whose technology assisted in identifying the vulnerabilities, as well as international partners to mitigate potential risks, a No 10 spokeswoman confirmed.
No indication of hacking
The Downing Street spokeswoman told journalists: "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue. No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues."
The spokeswoman suggested it was not "standard practice" to reveal which Government services had been affected. Cybersecurity specialists warned UK organisations on Wednesday of a "critical security issue" in PHP, software used by nearly 70% of websites according to cybersecurity firm Cloudflare.
Budget security assured
Lady Lloyd disclosed that the NCSC received a briefing from OpenAI regarding the vulnerability "last week" and "the Government acted proactively ahead of public disclosure". The NCSC has encouraged organisations to update to the latest, patched version of PHP software – or consider temporarily taking down their websites should immediate updates prove unfeasible. The No 10 spokeswoman added: "Organisations of all sizes should follow NCSC guidance to protect their system."
Meanwhile, a minister has insisted next week's Budget remains secure. Scottish Secretary Douglas Alexander was asked whether the PHP vulnerabilities could lead to significant Budget leaks, given the Office for Budget Responsibility (OBR) was compelled to suspend its website. Mr Alexander told Times Radio on Thursday morning: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security. Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer."
Last year, the OBR's budget analysis was mistakenly published online before then-chancellor Rachel Reeves's statement to the Commons, granting early access to market-sensitive information. The PHP security vulnerability could allow hackers to remotely take control of web servers running on PHP, which underpins popular platforms including WordPress and Magento. Multiple attempts to exploit the weakness were identified within hours of it becoming public knowledge, according to both Amazon and Cloudflare. In a statement published on the Amazon Web Services security blog, the technology company disclosed its threat intelligence team had determined that the flaw was "now being broadly exploited in the wild".
