Two critical security flaws in PHP known as PHP2Shell have forced 32 UK government services completely offline and left another four partially unavailable, according to disclosures made in the House of Lords on Thursday. Tech minister Baroness Lloyd of Effra told peers that the widespread disruption resulted mainly from protective steps taken while security patches and fixes are rolled out. Whitehall has not released a complete list of impacted services, though the Office for Budget Responsibility is among those confirmed to have pulled their websites down, creating an awkward timing issue with next week's Budget approaching.
The shutdowns aren't limited to Britain. Government websites in Germany, France, Belgium, Finland, and the Netherlands have also gone dark as a precautionary measure, along with Australia's cybersecurity agency site. Peers raised concerns about disruption hitting the DVLA and police services, while Liberal Democrat Baroness Ludford flagged several councils whose services reportedly went offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet. Across the Atlantic, the NSA has pressed organizations to patch or disconnect at-risk systems, though the US government hasn't publicly confirmed any website closures. The two vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619, could let attackers who haven't logged in run code on servers that remain unpatched.
Lloyd said the National Cyber Security Centre received a briefing from OpenAI last week on the potential vulnerability and has worked to ensure disclosure happened in coordination with vendors, giving them enough preparation time to protect customers. Security firm Calif discovered one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz separately found both flaws with assistance from AI tools. OpenAI then investigated the vulnerabilities itself and coordinated with vendors and government agencies to spread the word. The government set up a cross-departmental incident response operation before the public announcement, and the NCSC sent 50,000 warnings to businesses and other organizations. "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," Lloyd told peers, later broadening that assessment to cover the wider UK public sector.
The National Cyber Security Centre warned organizations to apply patches immediately or think about taking affected systems offline until repairs could be completed. The urgency stems from evidence that attackers are already actively exploiting the weaknesses—AWS reported that threat actors were weaponizing the flaws four days before they became public knowledge, while Cloudflare has since logged millions of exploitation attempts. The government is now working carefully with departments to bring services back online safely and securely following the fix-it work, Lloyd explained. Baroness Ludford questioned why central government and local authorities remain outside the statutory obligations proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday.
For organizations that rely on PHP-based infrastructure, the incident represents a reminder that defensive shutdowns may be the lesser evil when confronting zero-day threats. The bill's timing couldn't be sharper, arriving just as the gap between voluntary guidance and enforceable standards has been exposed in real time.