By: Nana Karikari, Senior Global Affairs Correspondent
Thirty-two British government services are offline and four face partial disruption while1 authorities mitigate a severe software vulnerability.
The preventative shutdowns follow the discovery of a critical security flaw in PHP, a foundational programming language that collects required information and presents it in a readable web format for nearly 70 percent of websites worldwide.
Tech minister Baroness Lloyd of Effra confirmed the scale of the disruption in an address to the House of Lords.
“The information I have is that 32 government services are unavailable and four are partially unavailable,” Lady Lloyd stated. She added that the disruption “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied.”
System Safety Assured
Downing Street maintains that core public operations remain fully protected despite the widespread disruption. A spokeswoman confirmed that “no large public-facing critical services are being affected,” while noting that some “limited services may temporarily be offline” while technical teams carry out necessary maintenance.
Government officials emphasized that taking systems offline does not indicate a security breach. “This does not mean they were hacked, and work continues to resolve any issues,” the Downing Street spokeswoman added. She noted that “work has already taken place across government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.” Downing Street declined to provide a list of affected services, stating it was not “standard practice” to do so.
Global Infrastructure Threat
The underlying flaw lies within PHP, the web programming engine that powers the internet. Left unpatched, the vulnerability allows attackers to remotely control web servers running PHP, endangering widely used content management and e-commerce platforms such as WordPress and Magento. A security researcher who helped identify the flaw categorized it as “the most serious” issue he has ever found.
Cybersecurity agencies and major web infrastructure platforms responded immediately to the emerging threat. Internet infrastructure platform Cloudflare reported seeing “millions” of hacking attempts on its network, though it confirmed there is no evidence that these attempts were successful. Meanwhile, Amazon Web Services issued a formal security blog update confirming that its threat intelligence team found the flaw was “now being broadly exploited in the wild” within hours of becoming public.
International Response
The National Cyber Security Centre (NCSC) took quick action after receiving advance warning about the vulnerability. Lady Lloyd disclosed that the NCSC was officially briefed on the issue “last week” by artificial intelligence research lab OpenAI, allowing the UK government to act “proactively ahead of public disclosure.”
The NCSC issued urgent directives advising UK organizations to upgrade to a fixed version of the PHP software or take vulnerable websites offline if immediate updates are impossible.
“Organisations of all sizes should follow NCSC guidance to protect their system,” the Downing Street spokeswoman reiterated. Similar precautionary steps are taking place globally, with governments, banks, airlines, and telecommunications firms across countries including Japan, France, Finland, China, and South Korea taking web portals offline to deploy critical security patches.
Budget Security Intact
The temporary shutdown of the Office for Budget Responsibility (OBR) website raised concern regarding potential security leaks surrounding the upcoming national Budget presentation. Last year, premature publication of the OBR budget analysis allowed early access to market-sensitive information before the Chancellor’s statement to the Commons.
Scottish Secretary Douglas Alexander dismissed concerns about potential security breaches during an interview with Times Radio.
“No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security,” Mr. Alexander stated. “Indeed John Healey, who I was with yesterday in Scotland, as I understand it, initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.”
Infrastructure Resilience
The widespread temporary offline status of both public and private digital portals highlights the interconnected nature of global internet infrastructure.
While the proactive taking down of systems creates temporary operational inconvenience, cybersecurity experts emphasize that rapid server isolations remain the safest defense against zero-day exploits.
As patch deployments continue across international networks, authorities maintain that preventative action is the most effective approach to safeguarding public data and critical national infrastructure.
