Websites taken offline as 'critical' security flaw hits Met Police, Traitors and government sites

Dozens of critical government and police websites have been taken offline amid cyber security fears.

Listen to this article

Edinburgh and Oxford Council as well as the online for The Traitors were taken down as was The Met Police website.

According to internet monitoring website Down Detector online gaming platform Steam, Google Drive and Wordpress were all down alongside a raft of local authority websites.

Error messages were displayed on the Bristol, Lambeth and Barnet council websites.

Finland has temporarily shut down the government's public web services, while the Netherlands' cyber-security agency said it was taking its own website offline due to the vulnerabilities.

It comes after the National Cyber Security Centre (NCSC) urged UK organisations to prepare for emergency updates to software used to run websites around the world, amid fears hackers could exploit the weaknesses to break into their systems.

Fixes were due to be released at 3pm BST on Wednesday, October 21, although they could arrive earlier.

The NCSC warned: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”

The flaws affect PHP, software that works behind the scenes to keep websites running, including those built using popular platforms such as WordPress.

European cyber officials have warned that the weaknesses could allow hackers to run their own commands on vulnerable systems without needing to log in. Full details of the flaws and which versions are affected have yet to be published.

The warning means some website owners could face having to temporarily take their services offline while they wait for protection to be put in place.

Cloudflare’s chief technology officer, Dane Knecht, said the company was already seeing early attacks and was updating its firewall protections.

“We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update,” he wrote on X.

For website owners, updating the website itself may not be enough. WordPress security company Wordfence warned that automatic WordPress updates would not install the PHP fix, advising owners to establish who is responsible for updating the software on their servers.

CERT-EU has also urged organisations unable to apply fixes immediately to consider isolating affected internet-facing applications from public networks. It said versions dating back to PHP 5 could be affected, although PHP’s developers had yet to publish a definitive list of vulnerable versions.

The PHP security team said full details of the vulnerabilities, affected versions and fixes would be published alongside the release. It also warned that updates could arrive ahead of schedule if details became public or evidence of active exploitation emerged.