UK minister says Budget safe despite critical PHP flaw

Douglas Alexander said there is no indication of a breach to the upcoming budget, even as the National Cyber Security Centre warns organisations to patch PHP.

By Felo News Desk · Published Thu, 22 Oct 2026 09:54:48 GMT

Scotland Secretary Douglas Alexander told Times Radio on Thursday that there is no indication the upcoming UK Government Budget has been compromised by a critical security flaw in the PHP programming language.

What happened

The flaw, discovered by a researcher using AI tools, affects virtually all versions of PHP and could allow attackers to remotely control web servers running the language. Cyber‑security chiefs warned UK organisations on Wednesday that the issue could force websites offline if they cannot upgrade immediately. The National Cyber Security Centre (NCSC) has urged operators to install the emergency patches released on 21 October or consider taking sites offline.

What the reports add

Both Standard and The Independent reported Alexander’s statement that he has “no indication whatsoever that there’s any problem in terms of a breach of Budget security.” The Standard noted that Alexander was with John Healey in Scotland the day before and said Healey had initiated new security protocols based on his Ministry of Defence experience. The Independent added that the Office for Budget Responsibility (OBR) had taken down its website after the flaw was flagged.

What was said

"No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security," Alexander told Times Radio, as reported by both outlets.
"Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer," Alexander added, according to Standard.

How it came about

The vulnerability was identified by an AI‑driven researcher and publicly disclosed on 20 October. Exploitation attempts were detected by AWS on 17 October, four days before the public patch release. PHP maintainers issued emergency patches on 21 October, fixing the two high‑severity flaws (CVE‑2026‑109618 and CVE‑2026‑109619). The NCSC’s advisory follows those patches, urging immediate updates. Last year, the OBR’s budget analysis was mistakenly published online ahead of a Treasury statement, prompting heightened vigilance this time around. For earlier coverage of the PHP patches see PHP emergency patches released.

Key facts

Scotland Secretary Douglas Alexander said there is no indication of a budget breach linked to the PHP flaw. (standard.co.uk)
The PHP vulnerability could allow remote control of web servers and affects almost 70% of websites. (standard.co.uk)
The National Cyber Security Centre urged organisations to apply the emergency PHP patches released on 21 October. (independent.co.uk)
John Healey was with Alexander in Scotland and reportedly initiated new security protocols. (standard.co.uk)