UK government takes dozens of services offline while fixing PHP vulnerability

A minister said precautionary shutdowns were needed while security updates are applied to address the PHP issue discovered with AI assistance.

By Felo News Desk · Published Thu, 22 Oct 2026 16:40:26 GMT

Thirty-two UK government services were unavailable and four were partially unavailable on Thursday, Oct 22, as officials worked to mitigate a critical security flaw in the PHP programming language, according to a Downing Street spokeswoman.

What happened

Downing Street confirmed that no large public‑facing critical services were affected, but a number of limited‑scope websites were taken offline while security updates were applied. The National Cyber Security Centre (NCSC) said the work involved applying emergency patches released on 21 Oct 2026 and coordinating with OpenAI, whose technology helped uncover the vulnerability.

What the reports add

Both Standard and The Independent reported the same figures – 32 services fully offline and four partially – and quoted the same statement from tech minister Baroness Lloyd of Effra in the House of Lords. The Independent added that cyber‑security chiefs warned UK organisations that their websites might also need to be taken offline, echoing earlier warnings from CERT‑EU and the PHP Foundation.

What was said

Baroness Lloyd of Effra told the House of Lords: “The information I have is that 32 Government services are unavailable and four are partially unavailable,” and added that the shutdowns were “largely the result of precautionary measures taken to protect systems while security updates and mitigations are applied.” A Downing Street spokeswoman said: “Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.”

How it came about

The outage follows the discovery of two critical PHP vulnerabilities on 22 Oct 2026 that were rated 9.2 on the CVSS scale. The flaws, found using AI tools, could allow remote code execution on servers running the language, which powers the majority of websites. Earlier on 22 Oct, Felo News reported on the broader impact of the flaw, noting that the Office for Budget Responsibility and several local councils had already taken their sites offline (php-security-flaw-website-takedowns). The NCSC urged organisations to apply the emergency patches released on 21 Oct, and the UK minister for the budget, Douglas Alexander, later assured that the upcoming budget process was not compromised.

Key facts

32 government services were fully offline and four were partially unavailable on 22 Oct 2026. (standard.co.uk)
The National Cyber Security Centre is working with OpenAI to address the PHP vulnerability. (independent.co.uk)
Baroness Lloyd of Effra said the shutdowns were precautionary while security updates are applied. (standard.co.uk)
No large public‑facing critical services were affected, according to Downing Street. (independent.co.uk)

Timeline

2026-10-21 — Emergency PHP patches released by UK authorities.
2026-10-22 — Discovery of two critical PHP vulnerabilities rated 9.2 CVSS.
2026-10-22 — 32 government services taken offline and four partially unavailable.