UK government services offline over PHP2Shell vulnerability

Tech minister Baroness Lloyd of Effra disclosed figures regarding unavailable UK government services in the House of Lords on Thursday. The unavailability resulted largely from precautionary measures taken to protect systems while security updates were applied. Reports of disruption affecting the DVLA and police services were raised by peers in the House of Lords. Liberal Democrat peer Baroness Ludford pointed to several councils whose services had reportedly been taken offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet. The Office for Budget Responsibility took its website offline as a precaution ahead of the next week's Budget.

The disruptions stem from PHP2Shell, which comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allowing unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre warned organizations to patch immediately or pull affected systems offline until they could be fixed. The NCSC sent 50,000 warnings to businesses and other organizations regarding the vulnerabilities. Baroness Lloyd stated that the NCSC was briefed by OpenAI last week regarding the vulnerability to ensure coordinated disclosure. Security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz uncovered both flaws with the help of AI tools.

Government websites in Germany, France, Belgium, Finland, and the Netherlands were taken offline as a precaution alongside Australia's cybersecurity agency website. The NSA urged organizations to patch or disconnect vulnerable systems, though the US government did not confirm any website shutdowns. AWS says attackers were exploiting the flaws four days before they were publicly disclosed. Cloudflare CEO Matthew Prince stated that exploit attempts climbed into the millions since the announcement. Germany's BSI and Japan's government said they had not confirmed any successful break-ins resulting from the flaws. Baroness Lloyd stated that there is no confirmed compromise of central government systems resulting from these vulnerabilities.

The PHP Foundation spotted signs of one flaw in 2024 but called the delay in fixing it a structural failure. The PHP Foundation stated that without its funding it would have been impossible to have multiple people work on the issue full time.