More Than 30 Government Services Go Offline Amid PHP Cybersecurity Alert

Thirty-two Government services are currently offline and another four are operating with limited availability as officials respond to possible cyber-security risks, a minister told peers.

The disruption comes as organisations worldwide move to address a serious vulnerability in PHP, a programming language that supports a large proportion of the internet.

PHP is used to create and operate websites, including Government platforms that handle services such as tax submissions, driving and other licence applications, and benefits claims.

Baroness Lloyd of Effra, the technology minister, told the House of Lords that 32 Government services were unavailable, while four others were only partly accessible.

She explained that most of the disruption was linked to precautionary action, with systems being protected while security patches and other safeguards were put in place.

The minister did not name the affected services. However, officials confirmed that the Office for Budget Responsibility website had been taken offline temporarily.

The move followed a warning from cyber-security authorities that a critical PHP flaw had been identified. The software is used by nearly 70 per cent of websites, according to cyber-security company Cloudflare.

Baroness Lloyd said the National Cyber Security Centre was informed about the vulnerability by OpenAI last week, allowing the Government to take preventative steps before details of the issue were made public.

The NCSC has advised organisations to install the latest secure version of PHP. Where an immediate upgrade is not possible, website operators have been urged to consider taking their sites offline.

Downing Street said earlier that a small number of Government services could be taken offline temporarily while potential cyber-security weaknesses were investigated. It stressed that no major UK public-facing critical services had been affected.

A No 10 spokesman said work had already been carried out across Government to identify and address possible exposures. Cyber-security specialists are also continuing to coordinate with OpenAI and international partners.

The spokesman added that no major critical public services were affected by the exercise, although some limited services could remain offline during the security work. He stressed that temporary unavailability did not mean those systems had been hacked.

Downing Street said it was not normal practice to publish a full list of the Government services involved.

She also said: ‘Organisations of all sizes should follow NCSC guidance to protect their system.’

Scotland Secretary Douglas Alexander has insisted that the security of next week’s Government Budget has not been compromised by the critical security flaw.

He was asked whether the issues identified with PHP could result in major Budget leaks because the OBR had to take down its website.

Mr Alexander told Times Radio this morning: ‘No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.

‘Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.’

Last year, the OBR’s Budget analysis was mistakenly published online ahead of then chancellor Rachel Reeves’ statement to the Commons, allowing for early access to market sensitive information.

SEE ALSO: New Hope for Thousands of Men With High-Risk Prostate Cancer

Organisations have already been urged by the NCSC to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.

The security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.

Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudflare.

In an update published on the Amazon Web Services’ security blog, the company said its threat intelligence team found the flaw was ‘now being broadly exploited in the wild’.

Cloudflare chief executive Matthew Prince said today the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.

In a post on X, Mr Prince said: ‘In the ten hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it.

‘That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours and millions now.’

PHP developers had reportedly planned a security update today but the release was brought forward after details of its work to address the vulnerabilities leaked online.

Speaking to BBC Radio 4’s Today programme, Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said: ‘The cat was let out of the bag rather earlier than it was supposed to have been.

‘There was an embargo on this, and there’s always a window between the flaw being publicly known about and it being patched so that the attackers can’t successfully get in.

‘And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.

‘There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.

‘And that people like Amazon, Cloudflare, all sorts of companies that monitor what’s going on on the web, saw that this was being probed for.

He added: ‘We don’t know whether it’s being attacked but certainly people were probing websites to see, have you got that flaw?’

The Wall Street Journal previously reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

Professor Woodward explained the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting this security flaw would be ‘too complicated’, and nothing was done.

‘What then happened was during this year, as the large language models became more and more effective at analysing these things, people worked out how to exploit it, and that’s what’s been happening in the last week behind the scenes,’ Professor Woodward told BBC Radio 4.

‘People have been scrambling away, saying, “Well, actually, yes, you can exploit it, and we now need to patch it”.

‘And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place.’

Meanwhile an outage affecting MOT testing services in the UK is understood to have been related to the PHP incident.

The DVSA system, through which garages log their MOT records after testing vehicles, started experiencing issues yesterday afternoon until the issue was resolved this morning, according to the DVSA website.

Instead of filing information through the DVSA website, garages were instructed to use a paper system and upload the data at a later date, meaning tests could continue as normal during the outage.

An update on the DVSA website late this morning said the incident had been resolved.

READ MORE: Worldwide website emergency explained: How a critical PHP weakness sparked a global cyber-security alert – and exactly what it means for you