PHP2Shell puts dozens of UK government services out of service

The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web.

The figures were disclosed in the House of Lords on Thursday, where tech minister Baroness Lloyd of Effra outlined the disruption following the discovery of two critical flaws in PHP.

"Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers. "That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied."

"We are working very carefully with departments to restore the services safely and securely following that remediation activity," she added.

Whitehall has not published a full list of affected services, although the Office for Budget Responsibility (OBR) is among those known to have taken their websites offline, rather inconveniently with next week's Budget looming. Peers also raised reports of disruption affecting the DVLA and police services.

Britain isn't alone in pulling the plug. Government websites in Germany, France, Belgium, Finland, and the Netherlands have also been taken offline as a precaution, along with Australia's own cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, although the US government has not publicly confirmed any website shutdowns.

PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) warned organizations to patch immediately or consider pulling affected systems offline until they could be fixed.

"The NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers," Lloyd said.

Security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz separately uncovered both flaws with the help of AI tools. OpenAI then dug into the vulnerabilities itself and worked with vendors and government agencies to get the word out.

The government established a cross-departmental incident response operation before public disclosure, Lloyd said. The NCSC also sent 50,000 warnings to businesses and other organizations.

The disruption has spread beyond central government. Liberal Democrat peer Baroness Ludford pointed to several councils whose services had reportedly been taken offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet.

She questioned why central government and local authorities remain outside the statutory duties proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday.

"We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," Lloyd told peers, later extending that assessment to the wider UK public sector.

AWS says attackers were exploiting the flaws four days before they were publicly disclosed, while Cloudflare has since recorded millions of attempts to weaponize them. ®