PHP Flaw Fallout Widens: UK Confirms 32 Government Services Taken Offline as Precaution; Minister Says No Confirmed Compromise of Central Systems
LONDON — The critical vulnerabilities dubbed PHP2Shell are dragging more government services offline. Tech minister Baroness Lloyd of Effra told the House of Lords on October 22 that 32 UK government services are currently unavailable and four more are partially unavailable.
"Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers. "That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied." She added: "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," later extending that assessment to the wider UK public sector.
Whitehall has not published a full list, but the Office for Budget Responsibility (OBR) is known to have taken its website offline — awkward timing with next week's Budget looming. Peers also raised reports of disruption affecting the DVLA and police services. Beyond central government, councils including Edinburgh, Oxford, Bristol, Lambeth and Barnet have reportedly taken services offline.
Britain is not alone. Government websites in Germany, France, Belgium, Finland and the Netherlands have also been taken offline as a precaution, along with Australia's cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, though the US government has not publicly confirmed any shutdowns.
PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) has sent 50,000 warnings to businesses and other organizations. Lloyd said the government established a cross-departmental incident response operation before public disclosure, and that the NCSC was briefed by OpenAI last week on the vulnerability to coordinate disclosure with vendors.
On discovery: security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz independently uncovered both flaws with SI tools. AWS says attackers were exploiting the flaws four days before public disclosure, while Cloudflare has recorded millions of attempts to weaponize them.
Source: GSM · USA (original Chinese edition)
Photo: 图：伦敦白厅和平纪念碑（资料图）。Godot13 摄，CC BY-SA 4.0，经维基共享资源（Wikimedia Commons）。Photo: The Cenotaph, Whitehall, London (file photo). By Godot13, CC BY-SA 4.0, via Wikimedia Commons.
- 2026-10-21SI Finds Critical PHP Flaw Affecting 70% of Websites; White House Moves to Expedite Fix
- 2026-10-22Dutch Parliament and Cyber Security Centre Websites Taken Offline as Precaution Over Critical PHP Flaws
- 2026-10-22Exploit Attempts Reach Millions Within Hours of PHP Flaw Disclosure; Government Websites Go Offline in Europe and MUFG Suspends Some Online Services
- 2026-10-22PHP Flaw Fallout Widens: UK Confirms 32 Government Services Taken Offline as Precaution; Minister Says No Confirmed Compromise of Central SystemsThis story
- 2026-10-23Follow-Up: PHP2Shell Response Enters Day Two as NSA, FBI and CISA Detail Patch-or-Offline Steps and the National Writers Union Takes Its Site Down as a Precaution
