Thirty-two Government services are offline and four are partially unavailable while work is carried out to address potential cybersecurity issues, a minister has said, reports BritPanorama.
Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP used by the majority of websites.
Downing Street on Thursday stated that no large UK public-facing critical services have been affected; however, some “limited” Government websites have gone dark while issues are resolved.
Experts from the National Cyber Security Centre (NCSC) are collaborating with OpenAI, the firm that uncovered the vulnerabilities, and partners worldwide to resolve the issues, a No 10 spokeswoman confirmed.
Tech minister Baroness Lloyd of Effra informed the House of Lords: “The information I have is that 32 Government services are unavailable and four are partially unavailable.”
She explained that this primarily results from “precautionary measures” aimed at protecting systems as security updates are applied.
The Downing Street spokeswoman elaborated: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.”
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out,” she added.
“But this does not mean they were hacked, and work continues to resolve any issues.”
She indicated that it was not “standard practice” to disclose a list of the Government services impacted.
This situation follows cybersecurity warnings issued on Wednesday, indicating a “critical security issue” in PHP, utilized by nearly 70% of websites according to cybersecurity firm Cloudflare.
Lady Lloyd noted that the NCSC was briefed by OpenAI about the vulnerability “last week” and that “the Government acted proactively ahead of public disclosure”.
Organisations have been urged by the NCSC to upgrade to a new, fixed version of the PHP software or consider taking their websites offline if immediate upgrades are not feasible.
The No 10 spokeswoman commented: “Organisations of all sizes should follow NCSC guidance to protect their system.”
Earlier, a minister reassured that the security of next week’s Budget has not been compromised.
Scottish Secretary Douglas Alexander was queried on whether issues associated with PHP might lead to significant Budget leaks due to the Office for Budget Responsibility (OBR) having to take down its website.
Mr. Alexander responded on Times Radio: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.”
“Indeed, John Healey, who I was with yesterday in Scotland, as I understand it, initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.”
Last year, the OBR’s budget analysis was mistakenly published online ahead of then-Chancellor Rachel Reeves’s statement to the Commons, allowing for early access to market-sensitive information.
The newly identified PHP security issue could enable attackers to gain remote control over web servers running the software, which supports popular platforms including WordPress and Magento.
Within hours of the announcement, many attempts to exploit the vulnerability were detected, according to Amazon and Cloudflare.
Amazon’s security blog reported that their threat intelligence team found the flaw “now being broadly exploited in the wild”.
Cloudflare chief executive Matthew Prince indicated on Thursday that the firm registered hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.
Although PHP developers had anticipated a security update on Thursday, the release was expedited after details of the vulnerabilities were leaked online.
Alan Woodward, a visiting professor at the Surrey Centre for Cyber Security (SCCS), noted that “the cat was let out of the bag rather earlier than it was supposed to have been”.
“There’s always a window between the flaw being publicly known and it being patched so that the attackers can’t successfully get in,” Professor Woodward explained on BBC Radio 4’s Today programme.
“What happened, unfortunately, was that the day before the patch was rolled out, somebody let the cat out of the bag.”
“An initial version of the patch was released, making it easy to compare the original code with the patched version and identify which code needed to be exploited.”
The Wall Street Journal reported that Ryan Austin, a researcher at the cybersecurity firm Calif, discovered the flaw in August using an advanced AI model developed by OpenAI.
Professor Woodward revealed that human researchers had previously identified the vulnerability in 2024 but thought that exploiting it would be “too complicated”, resulting in no action being taken at that time.
“People have been scrambling away, saying, ‘Well, actually, yes, you can exploit it, and we now need to patch it’,” he observed.
“The patch came out yesterday afternoon; fortunately, the PHP Foundation issued one, which is why everybody’s scrambling to ensure that it is in place.”
