PHP cyber-security crisis live as UK government issues statement

A major cyber security flaw is affecting millions of websites across the world. On Wednesday cybersecurity chiefs warned UK organisations that a "critical security issue" had been discovered in the programming language PHP, which is used by almost 70% of websites, according cybersecurity firm Cloudflare.

Organisations around the world are scrambling to fix the security flaw, which has been described by the researcher who found it as "the most serious issue" he has ever discovered.

Cloudflare said it saw "millions" of hacking attempts on a range of organisations around the world who use the programming language after news of the flaw was leaked.

The UK's National Cyber Security Centre (NCSC) has urged those who use PHP to fix the critical security flaw. The NCSC said in a statement: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."

Downing Street has shared a statement today as some government services have been affected while work is carried out.

Surfshark is a Virtual Private Network tool that helps protect sites and helps prevent malicious viruses.

You can find out the latest updates via our live blog below, including what it means for services in the UK.

Issue is on 'unprecedented scale'

The NCSC said the scale of the issue was “unprecedented” and warned it would likely not be the last.

Chief technology officer Ollie Whitehouse said the centre had been carrying out a “co-ordinated disclosure process” warning organisations of the vulnerability after it was identified months ago.

He said: "We’re in an era now of digital dependency, coupled with heightened cyber threat, coupled with kind of increasing capability, which means all organisations are going to likely have to revisit their risk assumptions and work out how they are able to invest in technology to be able to meet the contemporary era."

Possible Budget leaks?

Scottish Secretary Douglas Alexander was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website.

Mr Alexander told Times Radio on Thursday morning: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.

“Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.”

Feels like a 'unexploded bomb', says Technology and AI editor

Zoe Kleinman, the BBC's Technology and AI editor, said the PHP incident feels like the "cyber equivalent of an unexploded bomb."

She added she had never seen such a "dramatic" and global" response to a cyber event.

Issues started yesterday afternoon

An outage affecting MOT testing services in the UK was related to the PHP cyber incident, it is understood.

The DVSA system, through which garages log their MOT records after testing vehicles, started experiencing issues yesterday afternoon until the issue was resolved this morning, according to the DVSA website.

Instead of filing information through the DVSA website, garages were instructed to use a paper system and upload the data at a later date, meaning tests could continue as normal during the outage.

An update on the DVSA website at 11.34am on Thursday said the incident had been resolved.

The UK's National Cyber Security Centre (NCSC) has urged those who use PHP to fix the critical security flaw. They have advised organisations to update or take their systems offline.

The PHP security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.

Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.

32 government services offline

Thirty-two Government services are offline and four are partially unavailable while work is carried out to address potential cybersecurity issues, a minister has said.

Statement from Downing Street

Some “limited” Government services may temporarily be offline while work is carried out to address potential cybersecurity issues, Downing Street has said.

A No 10 spokeswoman said: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.

“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues.”

The spokeswoman said it was not “standard practice” to provide a list of Government services that were affected.

UK websites taken down

Various websites across the UK have been taken down due to the issue, which was first announced on Wednesday (October 21). Oxford City Council and the City of Edinburgh Council were among the organisations to take their websites offline, while pages for some BBC programmes were unavailable.

It is now understood some of the Government’s online services may be temporarily unavailable.

A researcher using AI discovered a “critical security issue” in a programming language, called PHP. This is used by almost 70% of websites, according cybersecurity firm Cloudflare.

Cloudflare said it saw "millions" of hacking attempts on a range of organisations around the world who use PHP after news of the flaw was leaked.

Cyber security chiefs have warned UK organisations their websites may have to be taken offline. We'll be providing the latest updates on our live blog.