Downing Street has confirmed that some government services may be temporarily offline after cybersecurity chiefs warned of a critical flaw in PHP, the programming language that underpins a large share of the world's websites.
A No 10 spokeswoman told reporters on Thursday that no large public-facing critical services had been affected but that some limited services might be unavailable while security work was carried out. "But this does not mean they were hacked, and work continues to resolve any issues," she said.
Baroness Lloyd of Effra, the technology minister, told the House of Lords on Thursday that 32 government services were unavailable and four partially unavailable, according to PA Media. "The information I have is that 32 Government services are unavailable and four are partially unavailable," she said. She said the outages had "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".
The government has not named the services affected. The No 10 spokeswoman said it was not "standard practice" to provide a list, and she said organisations of all sizes should follow guidance from the National Cyber Security Centre (NCSC).
The NCSC has told UK organisations to patch their systems urgently. In its alert, published on Wednesday, it said: "The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619)." The agency said the flaw "may allow attackers to execute commands on any web server running PHP" and "has now been fixed".
The two vulnerabilities, known collectively as "PHP2Shell", allow an attacker to run code on an affected server without logging in. Each is rated 9.2 out of 10 on the CVSS v4.0 severity scale, according to PHP's security team. The US Cybersecurity and Infrastructure Security Agency said the flaws "affect all PHP installations serving web requests".
PHP released fixed versions on Wednesday at about 13:30 UTC, according to CERT-EU,, a day earlier than planned, after the vulnerability identifiers leaked online on Tuesday. Older versions of the language that are no longer supported will not receive an official fix, according to the security firm Tenable.
Cloudflare, which provides web security services, estimates that almost 70% of websites use PHP. Its chief technology officer, Dane Knecht, said on Wednesday that the company was seeing early attacks and was updating its defences as new methods appeared.
The Office for Budget Responsibility took its website offline, GB News reported, with the watchdog saying it had acted "in view of the critical security issues affecting PHP". The outage comes ahead of the Budget. Asked on Times Radio whether Budget security had been compromised, Douglas Alexander, the Scotland Secretary, said: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security."
Lady Lloyd told peers that the NCSC had been briefed on the vulnerability by OpenAI last week and that "the Government acted proactively ahead of public disclosure". OpenAI has said its models found the flaw, with the company's president, Greg Brockman, describing it as "one of the most severe bugs in open source software found in recent memory". The security firms Calif and Wiz have also been named as discoverers.
The UK is not alone in taking systems down. Government services in the Netherlands, Finland, France, Canada and Australia have been taken partly or wholly offline, according to reports by CNBC, CBC, ABC Australia and The National, and the Dutch NCSC took its own website offline.
Whether any UK government system was compromised before it was patched has not been established. The Lords exchange has yet to be published in Hansard, and the government has given no timetable for restoring the services that remain offline.
Join the Discussion
Have something to say? Join the conversation!
Sign in to share your thoughts and engage with other readers.
Sign In Create AccountNo comments yet
Be the first to share your thoughts on this article!