Over 30 Government Services Offline Due to Critical PHP Vulnerability

Thirty-two government services are currently offline and four are partially unavailable due to a critical security flaw discovered in the PHP programming language, a minister revealed in the House of Lords. Organizations globally are working to address the vulnerability, which affects a significant portion of websites.

Tech minister Baroness Lloyd of Effra stated that the unavailability of these services is largely a result of precautionary measures taken to protect systems while security updates and mitigations are applied. Downing Street confirmed that while some limited government services may be temporarily offline, no large, public-facing critical services have been affected, and this does not indicate a breach. Efforts are ongoing to identify and fix potential exposures, with experts collaborating with international partners.

Cybersecurity chiefs had previously warned UK organizations about the critical issue in PHP, a server-side scripting language essential for many web functionalities, including online transactions and forms. Cloudflare estimates that approximately 70% of all websites rely on PHP.

The National Cyber Security Centre (NCSC) was briefed on the vulnerability last week, prompting a proactive government response ahead of its public disclosure. The NCSC has urged organizations to update their PHP software to the latest fixed version or, if immediate upgrades are not possible, to consider taking websites offline.

The security flaw could potentially allow attackers to remotely control web servers running PHP, impacting platforms like WordPress and Magento. Cybersecurity firms Amazon and Cloudflare reported observing numerous attempts to exploit the vulnerability within hours of its announcement. Cloudflare's CEO Matthew Prince noted a significant increase in exploitation attempts following the public disclosure.

Originally, developers had planned to release a security update for PHP on a later date. However, details of the vulnerability and the planned fix leaked online, accelerating the release of the patch. Experts observed that an initial version of the patch made it easier for attackers to identify and exploit the flaw.

The vulnerability was reportedly discovered in August by a researcher using an advanced AI model developed by OpenAI. While human researchers had identified a similar issue earlier in 2024, it was initially deemed too complex to exploit. However, advancements in AI and large language models in recent months have enabled the development of methods to exploit the flaw, leading to a global scramble for patching.

In the UK, an outage affecting MOT testing services is understood to be related to this PHP incident. The Driver and Vehicle Standards Agency (DVSA) system experienced issues, but a paper-based system was implemented for garages to log MOT records, allowing tests to continue. The DVSA reported that the incident was resolved.

Scotland Secretary Douglas Alexander has stated that the security of the upcoming Government Budget has not been compromised by the PHP vulnerability. This assurance was given despite the Office for Budget Responsibility (OBR) having to take its website offline temporarily.