32 UK govt services go offline over cybersecurity issue

Thirty-two UK government services have gone offline, while four others are partially unavailable, following precautionary measures to address a potential cybersecurity vulnerability, a minister has said.

Tech Minister Elizabeth Lloyd disclosed this while addressing the House of Lords, explaining that the disruptions largely resulted from efforts to secure government systems as software updates and other protective measures were implemented.

The development follows the discovery of a critical security flaw in PHP, a programming language used by a large proportion of websites worldwide, prompting organisations to take urgent steps to protect their systems.

ALSO READ: Why US ordered embassy staff, families to leave Saudi Arabia

Downing Street said on Thursday that no major public-facing critical government services had been affected, although some websites had been temporarily taken offline while security checks and remedial work continued.

A No. 10 spokeswoman said experts from the National Cyber Security Centre (NCSC) were working with OpenAI, whose technology was used to identify the vulnerabilities, as well as international partners to investigate potential exposures and address the risks.

“Work has already taken place across government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” the spokeswoman said.

She stressed that the temporary unavailability of some services did not necessarily indicate a cyberattack, adding that efforts to resolve the issues were ongoing.

Lloyd said the NCSC had received a briefing from OpenAI on the vulnerability the previous week, enabling the government to take preventive action before the issue became public.

The NCSC subsequently urged organisations to upgrade to a patched version of PHP or consider taking affected websites offline if immediate updates were not possible.

The vulnerability is potentially serious because it could allow attackers to gain remote control of web servers running vulnerable versions of PHP, which supports widely used platforms, including WordPress and Magento.

Cybersecurity experts have also warned that attempts to exploit the flaw emerged shortly after its disclosure. Amazon Web Services said its threat intelligence team had found that the vulnerability was being widely exploited.

The incident has also raised questions about the security of next week’s UK Budget after the Office for Budget Responsibility (OBR) took its website offline.

However, Scottish Secretary Douglas Alexander said he had received no indication that the cybersecurity issue had compromised Budget security.

Speaking to Times Radio on Thursday, Alexander said he was unaware of any breach and noted that additional security protocols had been introduced at the Treasury.

The concern comes a year after the OBR’s Budget analysis was accidentally published online before then-Chancellor Rachel Reeves delivered her statement to the House of Commons, exposing market-sensitive information ahead of schedule.

Downing Street declined to identify the government services affected, saying it was not standard practice to publish such a list.

The government has urged organisations of all sizes to follow NCSC guidance and apply the necessary security updates to reduce the risk of exploitation.