UK takes 32 services offline after critical PHP flaws emerge
Two critical PHP vulnerabilities known as PHP2Shell have led the UK government to take 32 services offline and partially disrupt four others while updates and safeguards are applied. Ministers say the shutdowns are precautionary, and no compromise of UK central government or wider public sector systems has been confirmed.
The flaws, CVE-2026-109618 and CVE-2026-109619, could let unauthenticated attackers run code on vulnerable servers. The Office for Budget Responsibility is among the affected bodies; councils and government sites in several other countries have also reported disruption. The National Cyber Security Centre sent 50,000 warnings, while AWS said attackers were exploiting the flaws before public disclosure.
In short
- 32 UK government services are offline and four partly disrupted.
- Ministers report no confirmed public sector compromise.
- The NCSC sent 50,000 warnings as organisations patch.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Taking services offline is a prudent way to reduce exposure when critical flaws may allow unauthenticated attackers to run code, especially given reports of exploitation before public disclosure. Temporary disruption is a proportionate precaution if it gives teams time to apply updates and safeguards and helps protect sensitive public services; the reported absence of confirmed compromise does not rule out risk.
The case against
A broad shutdown can interrupt access to important public services and impose costs on people and organisations that rely on them, even when no compromise has been confirmed. A careful advocate would argue for prioritised patching, targeted safeguards and clear updates to users, so disruption is limited to systems whose exposure cannot be managed while they remain online.
Art Culture Government Politics UK World
Read the full article at the source →
Originally published by The Register as “PHP2Shell puts dozens of UK government services out of service”.