Thirty-two Government services offline amid PHP cybersecurity issue - Newswav

Downing Street has confirmed that 32 government services are currently unavailable and four are partially unavailable. This is a precautionary measure taken to protect systems while security updates and mitigations are applied.

The outage is linked to a critical security flaw discovered in the PHP programming language, which underpins a vast majority of websites globally. The National Cyber Security Centre (NCSC) is working with OpenAI, whose technology was used to identify the vulnerability, and international partners to address the issue.

Tech minister Baroness Lloyd of Effra provided an update to the House of Lords, stating that the information she has is that 32 Government services are unavailable and four are partially unavailable. She said this has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied.

A Downing Street spokeswoman clarified that no large, public-facing critical services are being affected by this exercise. However, some limited services may be temporarily offline while security work is carried out. She emphasized that this does not mean the services were hacked.

The NCSC was briefed by OpenAI on the vulnerability last week and the Government acted proactively ahead of public disclosure. The centre has urged organisations of all sizes to follow its guidance to update to a new, fixed version of the PHP software or consider taking their websites offline if they cannot be upgraded immediately.

The scale of the issue has been described as unprecedented by the NCSC's chief technology officer, Ollie Whitehouse. He warned that it would likely not be the last such issue, as the era of digital dependency, coupled with heightened cyber threats, means all organisations will need to revisit their risk assumptions.

The security flaw could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento. Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudflare.

In an update published on the Amazon Web Services security blog, the company said its threat intelligence team found the flaw was now being broadly exploited in the wild. Cloudflare chief executive Matthew Prince said the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.

The flaw was reportedly discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI. However, the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting the flaw would be too complicated.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online. Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security, explained that this premature disclosure created a dangerous window for attackers.

A minister has assured the public that the security of next week’s Budget has not been compromised. Scottish Secretary Douglas Alexander told Times Radio that he had had no indication whatsoever that there was any problem in terms of a breach of Budget security.

The Office for Budget Responsibility (OBR) had to take down its website as part of the precautionary measures. This follows a similar incident last year where the OBR’s budget analysis was mistakenly published online ahead of a statement to the Commons, allowing for early access to market-sensitive information.