SecurityDeveloping

Thirty-two UK government services offline as global PHP security patch rushed out

Minister confirms 32 services unavailable, four partially down; Downing Street says no large critical services affected and Budget security not compromised

By LineZotpaper

Published22 October 2026

Read Time3 min

Sources3 outlets

Thirty-two UK government services are offline and four are partially unavailable as a precautionary measure against a critical security flaw in the PHP programming language, a minister has confirmed. Downing Street said no large public-facing critical services have been affected, but work continues to apply patches after the vulnerability was disclosed early, forcing organisations worldwide to scramble.

What we know so far

A critical vulnerability in the PHP programming language was discovered by researchers using artificial intelligence, with cybersecurity firm Wiz describing it as the most severe ever detected by AI and OpenAI calling it one of the most impactful security issues in recent memory.
The UK government has taken some government services offline as a precautionary measure; Downing Street said no large public-facing critical services have been affected, but some limited services may be temporarily offline while security work is carried out.
Tech minister Baroness Lloyd of Effra said 32 government services are unavailable and four are partially unavailable.
The Office for Budget Responsibility took its website offline but it has been restored, and the body said the Budget has not been compromised by security issues.
The National Cyber Security Centre (NCSC) is working with OpenAI and international partners to address the issue.

How it unfolded

21 OctResearchers identify a critical security flaw in PHP using AI. (BBC News)
21 OctUK cybersecurity chiefs warn organisations about the vulnerability. (The Independent UK)
21 OctThe Office for Budget Responsibility takes its website offline as a precautionary measure. (City AM)
22 OctThe Office for Budget Responsibility website is restored. (City AM)
22 OctDowning Street says no large public-facing critical services have been affected, but some limited services may be temporarily offline. (The Independent UK)
22 OctBaroness Lloyd of Effra tells the House of Lords that 32 government services are unavailable and four are partially unavailable. (The Independent UK)

Tech minister Baroness Lloyd of Effra told the House of Lords on Thursday that 32 government services are unavailable and four are partially unavailable, adding that this "has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".

A No 10 spokeswoman said work has already taken place across government to identify and fix potential exposures, with experts continuing to work closely with OpenAI and international partners. "No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out," she said. "This does not mean they were hacked." She added it was not standard practice to provide a list of affected services.

Cabinet ministers moved to reassure the public about the security of next week's Budget after the Office for Budget Responsibility (OBR) took its website offline. Scottish Secretary Douglas Alexander told Times Radio he had no indication of any breach of Budget security, saying issues around OBR website security had been addressed after a previous leak last year.

The vulnerability in PHP, which is used by almost 70% of websites according to cybersecurity firm Cloudflare, was discovered in August by researcher Ryan Austin at the cybersecurity company Calif using an advanced AI model developed by OpenAI. The flaw could allow attackers to remotely control any web server running PHP.

PHP developers had planned a security update for Thursday, but brought the release forward after details of the patch leaked online. Professor Alan Woodward of the Surrey Centre for Cyber Security told BBC Radio 4's Today programme that the flaw had actually been identified by human researchers in 2024 but was then believed to be too complicated to exploit. "The patch came out yesterday afternoon – luckily, the PHP Foundation issued one," he said.

Organisations have been urged by the National Cyber Security Centre (NCSC) to update to the fixed version of PHP or consider taking their websites offline. Amazon Web Services reported that exploitation attempts were "now being broadly exploited in the wild", while Cloudflare CEO Matthew Prince said hundreds of thousands of hacking attempts were observed within two hours of the announcement.

Analysis

Why This Matters

The vulnerability forces a trade-off between keeping services online and ensuring security, affecting government and private-sector websites worldwide.
The early leak of the patch before it was widely deployed gave attackers a window to exploit the flaw, potentially increasing the risk for organisations that had not yet updated.
The incident highlights the growing role of AI in cybersecurity, the flaw was discovered using an AI model, and raises questions about the coordination of responsible disclosure.

Background

The PHP programming language powers approximately 70% of all websites, including major platforms such as WordPress and Magento. A critical remote code execution vulnerability was identified in August 2026 by researcher Ryan Austin using an OpenAI AI model. The NCSC was briefed by OpenAI the week before public disclosure. PHP developers planned a patch for 22 October but details of the fix leaked online the day before, prompting an early release. The same flaw had been identified by human researchers in 2024 but was initially deemed too complex to exploit.

Key Perspectives

UK Government and NCSC: Emphasise that no large critical services have been breached. The 32 offline services reflect precautionary measures. The NCSC is working with OpenAI and international partners to mitigate the risk. Cybersecurity experts (e.g., Professor Alan Woodward): Warn that the early patch leak created a dangerous gap between public knowledge and a fix. They stress the importance of immediate updating and note that the vulnerability is now actively exploited. Businesses and organisations: Face the urgent decision of whether to take websites offline while applying patches, balancing operational continuity against security. Cloudflare and Amazon confirm widespread exploitation attempts.

What to Watch

The timeline for restoring the 32 offline UK government services.
Whether other major websites or platforms report successful compromises before patches are applied globally.
Potential calls for changes to the responsible disclosure process when AI-assisted vulnerability discovery accelerates the cycle.

Sources

‘Limited’ Government services temporarily offline amid PHP cybersecurity issue · The Independent UK
Thirty-two Government services offline amid PHP cybersecurity issue · The Independent UK
UK government services offline after global PHP cybersecurity threat · The Independent UK

Checked

12 claims in this story checked against 1 source: 5 supported.

Show each claim

SupportedThirty-two UK government services are offline.The Independent UK: “Thirty-two Government services are offline and four are partially unavailable while work is carried out to address potential cybersecurity issues, a minister has said.”
Partly supportedA global PHP security patch was rushed out.The Independent UK: “PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.”
SupportedFour government services were partially unavailable.The Independent UK: “Thirty-two Government services are offline and four are partially unavailable while work is carried out to address potential cybersecurity issues, a minister has said.”
SupportedDowning Street said no large public-facing critical services were affected.The Independent UK: “No large UK public-facing critical services have been affected, a No 10 spokeswoman said on Thursday.”
SupportedThe Budget’s security was not compromised.The Independent UK: “Earlier, a minister said the security of next week’s Budget has not been compromised.”
Partly supportedThe services were unavailable as a precautionary measure against the PHP flaw.The Independent UK: “She said that “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied”.”
Partly supportedThe vulnerability was disclosed early, forcing organisations worldwide to scramble.The Independent UK: “Organisations around the world have been scrambling to address the flaw in PHP, which powers almost 70 per cent of websites according to cybersecurity firm Cloudflare.”
Partly supportedWoodward said, “The patch came out yesterday afternoon – luckily, the PHP Foundation issued one.”The Independent UK: ““And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place.””
Partly supportedRyan Austin at Calif discovered the flaw in August using an advanced OpenAI AI model.The Independent UK: “The Wall Street Journal had reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.”
Partly supportedCabinet ministers moved to reassure the public about Budget security after the OBR took its website offline.The Independent UK: “And a cabinet minister has insisted that next week’s Budget has not been compromised after the website for the OBR, the spending watchdog, shut down.”
Partly supportedIssues around OBR website security had been addressed after a previous leak last year.The Independent UK: ““historically there was vulnerabilities around the OBR forecasting process and the security of its website. Those have been addressed.””
SupportedCloudflare observed hundreds of thousands of hacking attempts within two hours of the announcement.The Independent UK: “Cloudfare chief executive Matthew Prince said on Thursday the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.”