UK Takes 32 Government Services Offline Over PHP Flaw as NCSC Says It Sees No Sign of Successful Hacks

Since PHP released emergency patches on Wednesday, Oct. 21, for two critical remote-code flaws, the fallout has reached the British government: 32 services are offline and four are partly unavailable.

Tech minister Baroness Lloyd of Effra gave the figures to the House of Lords on Thursday morning, Oct. 22. She said the outages "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied."

What Downing Street says is down

A Downing Street spokeswoman said no large public-facing critical services are affected. Some "limited" services may be offline while security work is carried out.

Her words: "But this does not mean they were hacked, and work continues to resolve any issues."

The spokeswoman declined to list the affected services. She said that is not "standard practice."

Ollie Whitehouse, chief technology officer at the National Cyber Security Centre, told BBC Radio 4's World at One there are "no indications" the flaw has been successfully exploited by hackers to breach government systems.

A leak forced the schedule

Whitehouse said the problem was identified months ago. The NCSC had been running a "coordinated disclosure process" to warn organisations quietly. A leak meant that process had to be accelerated, he said. He did not say who leaked it.

Lloyd gave a tighter timeline for the government's own involvement. She said OpenAI briefed the NCSC "last week" and that the government "acted proactively ahead of public disclosure."

The Wall Street Journal reported that the flaw was found in August by Ryan Austin, a researcher at the security firm Calif, using an advanced OpenAI model. OpenAI has called the discovery "one of the most impactful security issues in recent memory." Wiz, which helped uncover the flaws and has dubbed them "php2shell," called it the "most severe" it has detected.

Alan Woodward, a visiting professor of computer science at the Surrey Centre for Cyber Security, told BBC Radio 4's Today programme that human researchers had already flagged the weakness in 2024. It was judged "too complicated" to exploit, and nothing was done.

"People have been scrambling away, saying, 'Well, actually, yes, you can exploit it, and we now need to patch it,'" he said.

Attack traffic is surging

The government's no-breach line sits alongside heavy hostile activity elsewhere. Cloudflare CEO Matthew Prince posted on X that in the 10 hours before the public announcement, Cloudflare's network saw thousands of exploit attempts.

That jumped to tens of thousands in the 45 minutes after the announcement, he wrote, then hundreds of thousands within two hours. "Millions now," he said.

Attempts are not breaches, and Prince's figures say nothing about success rates. They do show how fast the exploit became a target once the details were public.

Woodward put the number of exposed sites at "something like 30 million." Wiz and Cloudflare each say PHP runs roughly 70% of websites, including WordPress, Magento and Wikipedia.

Woodward described the danger plainly. An attacker "can get their own code onto the web server and run it, and basically do whatever they like. They can steal data, they can go to other parts of your network... Even plant the backdoor to get in later."

Criminals are patching too

Cybercrime forums have also gone dark. Rebecca Taylor of Sophos said underground forums commonly depend on PHP-based software and plugins, so a remotely exploitable flaw threatens both the platforms and their operators.

Rival groups or police who get into a forum can unmask its members. The National Crime Agency did exactly that to the LockBit ransomware group in 2024.

Small businesses feel it

The disruption has reached ordinary operations. Dean, who owns an auto repair garage in Chepstow, told the BBC he could not process MOT tests online for 24 hours. He went back to pen and paper.

The system was back online by mid-afternoon Thursday. Dean said he and his staff will have to stay late to enter the paper-logged tests. He called it an inconvenience and said outages like this "do happen a few times a year," though they usually last two to three hours.

Beverley Griffiths, a senior lecturer in security and resilience at Bucks New University, called taking systems offline "a responsible precaution." She said the challenge is balancing security with keeping essential services running.

Whitehouse said he expects more of this. The episode shows that "technology is not a one-time purchase now," he said, and organisations will "have to revisit their risk assumptions." He said shutdowns like this one are likely to recur.

Still unanswered

The NCSC has updated its PHP alert to reflect the release of mitigations. It still advises organisations to upgrade to a fixed version or take sites offline if they cannot patch immediately.

Downing Street has not named the 36 affected services or said when they will come back. Until it does, the public cannot tell which government functions are unavailable or how long the outage will last.