# UK takes 32 services offline after critical PHP flaws emerge

- URL: https://talkfuse.com/story/php2shell-puts-dozens-of-uk-government-services-out-of-service/
- Published: 2026-10-22T16:05:53+00:00
- Updated: 2026-10-22T17:41:11+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/10/22/php2shell-puts-dozens-of-uk-government-services-out-of-service/5304840
- Topics: Art, Culture, Government, Politics, UK, World

## Key points

- 32 UK government services are offline and four partly disrupted.
- Ministers report no confirmed public sector compromise.
- The NCSC sent 50,000 warnings as organisations patch.

## Summary

Two critical PHP vulnerabilities known as PHP2Shell have led the UK government to take 32 services offline and partially disrupt four others while updates and safeguards are applied. Ministers say the shutdowns are precautionary, and no compromise of UK central government or wider public sector systems has been confirmed.

The flaws, CVE-2026-109618 and CVE-2026-109619, could let unauthenticated attackers run code on vulnerable servers. The Office for Budget Responsibility is among the affected bodies; councils and government sites in several other countries have also reported disruption. The National Cyber Security Centre sent 50,000 warnings, while AWS said attackers were exploiting the flaws before public disclosure.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.