Grade One Press

Technology reporting you can check

News · Security & privacy

UK takes 32 government services offline as agencies warn PHP flaw exploited before disclosure

Ministers disclosed emergency downtime across public digital services while cybersecurity agencies warned that automated attacks began four days prior to public alerts.

Grade One Newsroom · How this is written ↗ · 1 min read

Sources: 2 · top grade 1How evidence is graded

UK takes 32 government services offline to patch critical PHP vulnerability

Grade 1 · Primary

Source: UK Parliament

What changed
The UK government took 32 digital services offline for emergency patching, as cyber agencies warned attacks began four days before public disclosure.
Who it affects
Central UK public services and internet-facing servers running unpatched PHP web applications.
What it does not tell you
The statement did not name the affected government portals or confirm whether backdated forensic audits found intruder access.

The full story Check the source

The UK government took 32 public digital services completely offline while applying emergency patches for a critical PHP flaw [1]. Technology Minister Baroness Lloyd disclosed to the House of Lords that four additional services remained partially degraded [1].

Advisories from the Canadian Centre for Cyber Security and the US National Security Agency confirmed that automated attacks began on 17 October 2026 [2]. Telemetry across honeypots recorded exploitation of CVE-2026-109618 and CVE-2026-109619 four days before official advisories appeared [2].

Because exploitation began prior to public notification, servers cannot be secured solely by updating to PHP 8.5 [2]. Operators were advised to audit server access logs back to 17 October 2026 to detect any persistent web-shell compromise [2].

What it measures

Official ministerial confirmation of service interruptions across UK central government infrastructure, combined with technical telemetry from national computer emergency response teams and threat intelligence sensors [1] [2].

What it does not tell you

The ministerial statement did not disclose which 32 government services were shut down, nor did it state whether post-incident forensics discovered unauthorized intrusion on official servers prior to mitigation [1].

Sources and their grades

  1. UK Parliament, House of Lords Oral Statement on Government Digital Service Availability. Read 23 October 2026. Grade 1 · Primary Ministerial disclosure by Baroness Lloyd regarding emergency patching for CVE-2026-109618 and CVE-2026-109619.
  2. Canadian Centre for Cyber Security, Cyber Security Alert AL26-026: Critical PHP Vulnerabilities. Read 23 October 2026. Grade 1 · Primary Joint telemetry confirms exploitation against honeypots beginning 17 October 2026.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under Cybersecurity Infrastructure PHP UK government Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all