Thirty-two UK government services have gone offline and four others are partially unavailable as authorities respond to a cybersecurity vulnerability affecting software used by websites worldwide.
Tech Minister Elizabeth Lloyd disclosed the disruption while addressing the House of Lords, saying the outages largely resulted from precautionary measures, including software updates and other steps to secure government systems.
The issue centres on a critical flaw in PHP, a widely used programming language that supports websites and platforms such as WordPress and Magento. The vulnerability could allow attackers to take remote control of web servers running affected versions of the software.
Downing Street said on Thursday that no major public-facing critical government services had been affected, although some websites had been temporarily taken offline while security checks and remedial work continued.
A No. 10 spokeswoman said government experts were working with the National Cyber Security Centre (NCSC), OpenAI and international partners to identify potential exposures and address the risks.
“Work has already taken place across government to identify and fix potential exposures to our systems,” she said, adding that investigations and remedial work were continuing.
The spokeswoman stressed that the temporary unavailability of services did not necessarily mean a cyberattack had occurred.
Lloyd said the NCSC received a briefing from OpenAI about the vulnerability the previous week, allowing the government to take preventive action before the issue became public.
The cybersecurity agency subsequently advised organisations to upgrade to a patched version of PHP or temporarily take affected websites offline if they could not install the update immediately.
Concerns have grown after cybersecurity experts reported attempts to exploit the flaw shortly after its disclosure. Amazon Web Services said its threat intelligence team had found evidence of widespread exploitation.
The incident has also drawn attention to the security of next week’s UK Budget after the Office for Budget Responsibility (OBR) took its website offline.
However, Scottish Secretary Douglas Alexander said he had received no indication that the vulnerability had compromised Budget security. Speaking to Times Radio on Thursday, he said additional security protocols had been introduced at the Treasury.
The concern comes a year after the OBR accidentally published its Budget analysis online before then-Chancellor Rachel Reeves delivered her statement to the House of Commons, exposing market-sensitive information prematurely.
Downing Street declined to identify the affected government services, saying it was not standard practice to publish such a list.
The government has urged organisations to follow NCSC guidance and apply the recommended security updates to reduce the risk of exploitation.
Discussion0