Major cybersecurity threat LIVE: Updates as 32 UK government services taken offline

Websites across the world have been going dark after an exploit was found in the code used to build the sites. PHP, a programming language used for almost 70% of all websites, has had a critical vulnerability exposed in the last day.

Ministers in the UK say that 32 government services are currently unavailable due to the issue. Baroness Lloyd of Effra has given updates to the House of Lords, where she said the number of government services that are unavailable has "largely resulted" from precautionary measures taken to protect systems while updates and mitigations are applied.

They are working closely with departments to "restore the services safely and securely", she adds.

The issue with PHP was first identified on Wednesday, prompting warnings to governments and companies across the world to pull websites offline before they could be attacked.

Ciaran Martin, the former chief executive of the UK’s National Cyber Security Centre, described the flaw as “very bad”, saying that while most internet software vulnerabilities didn’t matter, this was “the most serious vulnerability discovered for five years”.

In an update overnight on Wednesday and into Thursday, Matthew Prince, the chief executive of the cybersecurity business Cloudflare, said the company encountered tens of thousands of attempts to exploit the weakness in the 45 minutes after the problem was announced, rising to “hundreds of thousands within two hours, and millions now”.

We bring you updates as they happen on the cybersecurity issue.

Streeting urges public to prepare for disruption from cyber emergencies

Defence Secretary Wes Streeting has warned that households and businesses should prepare for “increasingly sophisticated cyber attacks” and potential disruption to essential supplies.

It comes as households are being urged to take steps to be prepared if everyday services are temporarily disrupted.

The Government is launching a “be ready” campaign to provide advice to the public, including by gathering supplies and finding out how to volunteer to support communities during an emergency.

Mr Streeting said: “It’s really important that we ask households and businesses, are they prepared, are they ready, do they know how they would respond in the event of everyday challenges that might manifest themselves?

“But we’ll also need to take the country a step further and ask them are they prepared for increasingly sophisticated cyber attacks on our businesses, are they prepared for the eventuality that there may be disruption to essential supply chains caused by hostile state actors or terrorists?

“How would we cope if the payment systems at the local supermarket went down?

“Those are the sorts of everyday challenges and threats that we could face, and it’s right that we ask the country to be ready for those things and ask everyone to do their bit.”

AI helped find it, but a human found it first

It has been widely publiscised that OpenAI was partially responsible for finding the exploit. However, Professor Woodward explained the vulnerability had in fact already been identified by human researchers in 2024.

It was then believed exploiting this security flaw would be “too complicated”, and nothing was done.

“People have been scrambling away, saying, ‘Well, actually, yes, you can exploit it, and we now need to patch it’,” he said.

“And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place.”

Leak of exploit described as "the cat was let out of the bag rather earlier than it was supposed to have been”.

Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said “the cat was let out of the bag rather earlier than it was supposed to have been”.

“There’s always a window between the flaw being publicly known and it being patched so that the attackers can’t successfully get in,” Professor Woodward told BBC Radio 4’s Today programme.

“And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.

“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.”

Scope of PHP security issue explained

The PHP security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.

Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.

In an update published on the Amazon Web Services security blog, the company said its threat intelligence team found the flaw was “now being broadly exploited in the wild”.

Cloudfare chief executive Matthew Prince said on Thursday the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.

Open source software company Chainguard broke the embargo on publishing the exploit early, meaning some users were still waiting for fixes while information on how to exploit PHP was out in the open.

Budget will not leak as part of PHP issues

A minister said the security of week’s Budget has not been compromised.

Scottish Secretary Douglas Alexander was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website.

Mr Alexander told Times Radio on Thursday morning: "No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.

"Indeed, John Healey, who I was with yesterday in Scotland, as I understand it, initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer."

Last year, the OBR’s budget analysis was mistakenly published online ahead of then-Chancellor Rachel Reeves’s statement to the Commons, allowing for early access to market-sensitive information.

UK's National Cyber Security Centre statement in full

The UK's National Cyber Security Centre (NCSC) issued an alert yesterday as the issue was spread amongst government agencies.

"PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.

"PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user's browser. PHP is also used in a range of other products.

"The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed."

The NCSC issued a warning to those affected: "Organisations using any version of PHP are affected and all organisations are highly encouraged to update to the latest fixed version. Organisations using older versions of PHP are highly encouraged to update to a fully supported version."

US NSA addressed "critical vulnerabilities"

The US National Security Agency (NSA) issued a statement on the PHP issue yesterday:

"Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database.

"If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance."

PHP flaw discovered in August

The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

Professor Woodward explained that the vulnerability had actually been identified by human researchers in 2024. However, it was believed that exploiting this security flaw would be "too complicated," and ultimately, no action was taken.

"People have been scrambling away, saying, ‘Well, actually, yes, you can exploit it, and we now need to patch it’," he said.

"And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place."

An outage affecting MOT testing services in the UK was related to the PHP cyber incident. The DVSA system, through which garages log their MOT records after testing vehicles, experienced issues yesterday afternoon and was resolved this morning, according to the DVSA website.

Instead of submitting information via the DVSA website, garages were instructed to use a paper system and upload the data at a later date, so tests could continue as normal during the outage.

An update on the DVSA website at 11.34am on Thursday said the incident had been resolved.

Downing Street statement on PHP issue

The Downing Street spokeswoman told reporters: "Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.

"No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.

"But this does not mean they were hacked, and work continues to resolve any issues."

The spokeswoman said it was not "standard practice" to provide a list of Government services that were affected.

32 government services offline and four partially shut-down

Thirty-two government services are unavailable and four are partially unavailable amid the PHP cyber security issue, Tech minister Baroness Lloyd of Effra has said in the House of Lords.

She said that "has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied".

Downing Street on Thursday said no large UK public-facing critical services have been affected, but some “limited” Government websites have gone dark while issues are resolved.

Hello and welcome to the blog covering the ongoing PHP cybersecurity issue affecting global internet services.