PHP2Shell puts dozens of UK government services out of service
Ministers report 32 unavailable and four partly disrupted, but no confirmed compromise
32 UK government services have fallen offline and four remain partially inaccessible due to PHP2Shell, a pair of critical PHP vulnerabilities. Tech Minister Baroness Lloyd of Effra informed peers of the disruption, which occurred after two flaws were discovered in PHP. The Office for Budget Responsibility is among those whose websites are offline as the Budget approaches.
Whitehall is working to restore services safely and securely, but a full list of affected services has not been released. Other governments, including those in Germany, France, Belgium, Finland, and the Netherlands, have also taken precautionary measures. The NSA has advised groups to patch or disconnect vulnerable systems, though the US government has not confirmed any shutdowns.
The National Cyber Security Centre (NCSC) urged organizations to patch immediately or disconnect systems while it coordinated disclosure with vendors. AI tools found one of the bugs, and OpenAI helped inform government agencies. The government formed a cross-departmental incident response team, and the NCSC sent warnings to 50,000 businesses.
No confirmed compromise of central government systems has been reported, but several local councils have experience outages.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
