UK takes 32 government services offline in global PHP cyber alert

Government departments, councils and companies around the world have taken websites offline while they patch two critical flaws in PHP, a programming language used by an estimated 70% of websites. In the UK, Downing Street said 32 government services were unavailable and four partially unavailable. It said the outages were largely precautionary, that no large public-facing critical services had been affected and that there was no confirmed compromise of central government systems.

PHP is a server-side language that helps websites fetch data, fill forms and log users in. It dates from 1995 and is maintained by the PHP Foundation, a non-profit. The flaws allow an attacker to run commands on a vulnerable server without logging in or knowing a password. Security experts rate the risk as very serious, initially 10 out of 10 and later 9.2.

Researchers at the PHP Foundation found a theoretical flaw in 2024 but could not prove it was exploitable. This year, researchers using AI tools from OpenAI and security firms including Wiz found two exploitable flaws. A patch was prepared, but details leaked before many organisations could apply it. One company accidentally posted a video showing how the exploit worked, and the details spread on hacking forums. Cloudflare's chief executive said attempted exploits rose from thousands before the public announcement to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions later. Amazon said it detected attempts to exploit the flaws.

Governments in Finland, the Netherlands, France, Germany, Belgium, Australia and Scotland took sites down, as did parts of the BBC, Wikipedia, Amazon, WordPress and the Pokemon Company's apps. In the UK, the Ministry of Justice, the Victims Commission, the National Archives, the Office for Budget Responsibility and councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet reported disruption. The DVSA site for checking MOT status was running, but garages said they could not submit MOT results online and used pen and paper. The OBR site and WordPress later came back, while some BBC programme pages remained down.

The UK National Cyber Security Centre sent 50,000 warnings to organisations and told them to patch or take systems offline. Its chief executive said time was available but not limitless. Downing Street said limited services might be temporarily offline while work was carried out. The government minister Baroness Lloyd told the Lords that 32 services were unavailable and four partially unavailable, mostly because of precautionary measures. Downing Street said no large public-facing critical services were affected. The US National Security Agency urged affected organisations, up to 30 million websites, to take systems offline while a fix was found.

Experts said individuals can do little beyond keeping their own software up to date and asking website hosts whether PHP has been patched. Older versions of PHP, including many used by small businesses and abandoned sites, may not have a compatible patch. One estimate suggested a quarter of the top 15 million websites run older versions. Those sites may need to upgrade from PHP 7 to PHP 8.2 or later before applying the fix. Some may never be repaired and could become staging posts for future attacks.

The episode has highlighted both sides of AI. It was AI that helped find flaws that had gone unseen for more than a decade, and AI that helped attackers try to reverse-engineer exploits once details leaked. Some experts called the discovery a good news story because a patch exists. Others warned that the same race will recur as AI makes vulnerability hunting faster and cheaper. The Defence Secretary, Wes Streeting, used the moment to call for a national conversation on resilience, saying households and businesses should think about how they would cope with cyber attacks and other large-scale disruption.

By the latest updates, no confirmed data breach had been reported. The incident was a preventive scramble rather than a known hack. But security teams will keep checking old and unmaintained sites, and the long tail of vulnerable PHP installations is likely to remain a risk.