32 UK government services offline as critical PHP flaws trigger urgent security work

Thirty-two UK government services were unavailable and four were partly unavailable on Thursday as organisations rushed to secure websites against critical PHP vulnerabilities. The figures were given to the House of Lords by technology minister Baroness Lloyd of Effra, according to PA’s report published by LBC on 22 October. The disruption largely reflected precautionary protection while fixes were applied, rather than a confirmed tally of successful attacks.

Downing Street said no large, public-facing critical UK services had been affected. It also stressed that a website being taken offline did not mean it had been hacked. That distinction matters for anyone trying to use an online service today: a temporary closure can be a defensive decision, not evidence that personal information has been stolen.

What is PHP, and why does the warning matter?

PHP is software running behind the scenes on web servers. It helps websites produce pages, work with databases and process application logic before content reaches a visitor’s browser. The National Cyber Security Centre has confirmed that security updates are available for the issue. The emergency is therefore about finding exposed systems and applying protection, rather than waiting for a fix that does not yet exist.

A joint European statement from ENISA and other agencies identifies two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to run malicious code on a vulnerable server without first logging in. The agencies urge organisations to work with their hosting and service providers and give priority to systems exposed to the internet. They also warn that PHP may be bundled inside other products, even when its use is not obvious to an organisation.

Matthew Prince reports a sharp rise in attempts

Cloudflare chief executive Matthew Prince has described a rapid escalation in attempts detected across his company’s network. In the X post embedded below, he says activity rose from thousands before public disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours and millions by the time of his update. These are Cloudflare’s observations of attempts, not a count of organisations successfully breached.

The scale of scanning helps explain the urgency. Once information about a widespread weakness becomes public, defenders have to identify affected systems while attackers look for opportunities. A large number of requests can be generated automatically; it does not mean that each request represents a separate criminal or a successful intrusion. Readers should keep those differences in mind when comparing headlines and social-media figures.

Amazon’s evidence points to activity before disclosure

Amazon’s security team has published a separate account based on its MadPot threat-detection infrastructure. It describes an attempt on 17 October, before public disclosure, and further activity on 21 October. The company says it does not know how the earlier actor obtained information about the vulnerabilities. Its report is evidence of attempted exploitation observed by its monitoring systems, not proof that every business using Amazon services was compromised.

For technical teams, that earlier date is important. Applying a patch closes a vulnerability, but does not by itself establish whether somebody accessed a system beforehand. Amazon recommends looking back at activity from at least 17 October when investigating this issue. Organisations should follow their providers’ incident-response guidance rather than assuming that a successful update answers every security question.

What website operators should do

The NCSC’s updated guidance puts identification and patching first. Operators should locate PHP installations, apply the fixed software and monitor relevant third-party updates. Where immediate updating is impossible, the agency points to temporary mitigations supplied by the PHP Foundation. If those cannot be applied, or would take too long, it advises considering taking the system offline until it can be protected.

For a small business, the useful first step is to establish who manages the server software: an internal team, a developer or the hosting company. Ask that responsible party to confirm whether the service is affected and what action has been taken. A website’s appearance alone cannot tell its owner whether the underlying software has been updated.

What this means for everyday users

If a service is unavailable, look for an update from the organisation that operates it and use its published contact route for urgent questions. Do not infer that every unavailable website has the same cause. The government figures are a snapshot reported on Thursday, not a live dashboard of every affected service. Restoration times and individual service notices may change as security work continues.

Sources: PA/LBC government update · NCSC guidance · European security statement · Amazon threat research