Thirty-two UK government services were unavailable and four were partly unavailable on Thursday because of the PHP2Shell vulnerabilities, a minister told the House of Lords. She said the outages resulted largely from precautionary measures, not attacks.
“Currently, the information I have is that 32 government services are unavailable and four are partially unavailable,” Baroness Lloyd of Effra, a Parliamentary Under-Secretary of State, told peers, according to the uncorrected Hansard record of a private notice question that began at 12:02 BST. “That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied.”
PHP2Shell is the name given to two critical flaws in PHP, the web programming language, that PHP fixed this week. TSN’s earlier report on the PHP fixes covers the vulnerabilities, the patched versions and the vendors’ mitigations.
The minister said there is no confirmed compromise of central government systems
Lloyd did not play down the threat. “While we have seen exploitation activity in scanning being reported internationally, we are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities,” she said. Later in the exchange, she extended that to the rest of the country: “we are not aware of any compromises in the UK public sector, or in the UK as such.”
Lord Dixon of Jericho, the Liberal Democrat peer who asked the question, asked what assessment the government had made of the impact on its websites and digital services. Lloyd said departments had been alerted before public disclosure and told to “identify potential affected systems, assess their exposure and prepare to implement mitigations and security updates as they became available”. The Government Cyber Coordination Centre and the National Cyber Security Centre (NCSC) were coordinating the response across government, she said.
A No 10 spokeswoman told PA, as reported by The Independent, that “no large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out”. She added: “But this does not mean they were hacked, and work continues to resolve any issues.” Officials told PA it was not “standard practice” to list the affected services.
OpenAI briefed the NCSC last week, Lloyd told peers
The Earl of Kinnoull asked how long the government had known. “The NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers,” Lloyd said. “It is regarded as best practice to be able to mitigate the impact to prepare and disclose in a co-ordinated way.”
She said the NCSC “was able to make 50,000 proactive notifications to the wider economy to advise business and other organisations on what actions they should take”. The NCSC has not published that figure itself.
According to The Register, the security firm Calif found one of the bugs using OpenAI’s GPT-5.6 Sol model, and Wiz separately found both. The Register also reports that Cloudflare has recorded millions of attempts to exploit the flaws.
The NCSC advises patching, or taking systems offline until they are fixed
The NCSC’s alert tells organisations to find where they run PHP, update it and apply PHP’s temporary mitigations. Where that cannot be done, it says to “consider taking the system offline until it can be fully mitigated”. It also tells organisations to check for signs of compromise and backdoors.
Lloyd said the NCSC’s advice “is to mitigate and then restore the services”. PA reported that the NCSC described the scale of the issue as “unprecedented”. Ollie Whitehouse, its chief technology officer, told BBC Radio 4’s World At One that “all organisations are going to likely have to revisit their risk assumptions”.
Peers named the OBR, the DVLA, police and councils, The Register reports
Whitehall has not published a full list of affected services. The Register reports that the Office for Budget Responsibility (OBR) is among those that took their websites offline, a week before the Budget, and that peers raised disruption at the DVLA and police services. Lord Dixon referred to the OBR site going down, and Lord Bellingham to the DVLA and “perhaps police departments”, according to Hansard. Baroness Ludford named councils that had been taken offline: Edinburgh, Oxford, Bristol, Lambeth and Barnet. None of these has been independently confirmed. Douglas Alexander told Times Radio, according to PA, that he had “no indication whatsoever that there’s any problem in terms of a breach of Budget security”.
The Register also reports that government sites in Germany, France, Belgium, Finland and the Netherlands were taken offline as a precaution.
Peers pressed on the Cyber Security and Resilience Bill
Baroness Harding of Winscombe asked what more the government could have done if the Cyber Security and Resilience Bill were already law. Lloyd said managed service providers would be brought into scope, with “requirements for critical patching within defined timelines”. Ludford said the Bill leaves central government and local authorities outside its statutory duties, and asked for amendments at report stage on Monday. Lloyd said the government is “looking at future sectors that may be brought within it”.
Precautionary shutdowns, not confirmed breaches, explain the outages so far
The 32 offline services are a real cost to the public, and peers asked about delays and redress. But on the government’s own account, they are mostly the result of a defensive choice. The NCSC’s advice was to take systems offline until they could be fixed, and departments followed it. That trades availability for safety, and the minister said services would be restored once they had been fixed.
Much of the defensive work began before the flaws became public. By Lloyd’s account, OpenAI briefed the NCSC the week before, departments were told to find their exposure in advance, and vendors had patches ready when the flaws were disclosed. Lloyd presented this as frontier AI working for defenders: the bugs were found, she said, “ahead of potential exploitation”. The 50,000 notifications point the same way, although the NCSC has not published that figure.
The limits are just as clear. Lloyd’s assessment covers what the government is “currently aware” of, and exploitation and scanning are being reported abroad. As TSN’s PHP report records, Amazon says it saw an exploit attempt before disclosure. The NCSC warned in May, in a blog on a coming “patch wave”, that AI can exploit technical debt “at scale and at pace” and that organisations should prepare to patch quickly. This week’s Node.js and Oracle releases show how much patching that means. More incidents are collected in TSN’s ransomware and cyber attacks hub.
The Cyber Security and Resilience Bill returns to the Lords for report stage on Monday, where Ludford wants councils and central government brought within its duties.
Sources
- Hansard (uncorrected), House of Lords, 22 October 2026, “Cyber Security: PHP Vulnerability”, private notice question, 12:02 BST: https://hansard.parliament.uk/lords/2026-10-22
- Parallel Parliament, live House of Lords Chamber record, 22 October 2026: https://parallelparliament.co.uk/live/2026-10-22/lords-chamber
- NCSC, “Critical security issue affecting PHP” (published 21 October, updated 22 October 2026): https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
- NCSC blog, “Preparing for a ‘vulnerability patch wave'” (1 May 2026): https://www.ncsc.gov.uk/blogs/prepare-for-vulnerability-patch-wave
- The Register, “PHP2Shell puts dozens of UK government services out of service”, 22 October 2026, 17:05 BST: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840
- The Independent (PA), “Thirty-two Government services offline amid PHP cybersecurity issue”, 22 October 2026, 16:02 BST: https://www.independent.co.uk/news/uk/politics/ncsc-work-government-john-healey-office-for-budget-responsibility-b3071442.html
Related stories
- PHP Ships Fixes for Two Critical ‘PHP2Shell’ Flaws as Early Attacks Emerge
- Node.js Fixes Four High-Severity Flaws, Including a Brotli Code-Execution Bug
- Oracle Ships 1,295 Security Patches in October, Most for Fusion Middleware
- Ransomware and Major Cyber Attacks: TSN Story Hub
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
