UK government takes 32 services offline over PHP security flaw
Downing Street says a limited number of government websites have been temporarily taken offline after a critical security issue was found in the PHP programming language, though no major public-facing critical services were affected.
A limited number of UK government websites have been temporarily taken offline after cybersecurity officials identified a critical security issue in the widely used PHP programming language, Downing Street has confirmed. No 10 said no large UK public-facing critical services had been affected, but around 32 government services were reported to have gone dark as a precaution.
The National Cyber Security Centre warned UK organisations that a «critical security issue» had been discovered in PHP, the server-side scripting language that underpins a large share of the web. Downing Street did not provide details of which specific websites were affected, and it was not immediately clear how long the services would remain unavailable.
The disclosure follows the identification this week of severe vulnerabilities in PHP: Hypertext Preprocessor, a finding that cybersecurity experts said was reached with the help of artificial intelligence. Researchers warned that millions of sites worldwide could potentially be exposed, making the flaw one of the more significant software security events of recent months.
PHP is used by many content management systems, government portals and commercial platforms, which means a serious vulnerability can have consequences far beyond a single organisation. The decision to take services offline reflects a precautionary approach while patches and mitigations are assessed, rather than evidence that UK government systems were successfully breached.
The Office for Budget Responsibility and other public bodies were among those reported to have been affected by the temporary outages. The government has not said whether the affected sites contained sensitive data or whether any user information was put at risk.
Cybersecurity specialists have urged organisations running PHP-based systems to review their exposure and apply available fixes promptly. The warning applies to businesses, public bodies and other operators of websites and online services, not only to central government.
The incident highlights the dependence of modern public services on a relatively small number of widely used software components. A flaw in one such component can force administrators to choose between keeping a service online and removing it until a fix is verified.
Downing Street’s statement that critical services remain unaffected is likely to be tested in the coming days as technical teams work through the affected estate. Further updates on which services were taken offline and when they will return have not been provided.
4
