"Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Baroness Lloyd of Effra told the House of Lords, as Whitehall raced to patch two critical PHP flaws that have forced widespread precautionary outages.
Baroness Lloyd of Effra: the immediate toll on Whitehall services
That tally—32 services completely offline, four partially unavailable—was disclosed in the Lords as ministers described a rapid, precaution-driven shutdown of public-facing systems while security updates and mitigations are applied. The government has not published a full list of affected services. The Office for Budget Responsibility (OBR) is among the publicly known sites taken down, a notable disruption with next week’s Budget scheduled. Peers also reported disruption affecting the DVLA and police services.
Baroness Lloyd told peers the shutdowns "resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied," and that Whitehall had set up a cross-departmental incident response operation "before public disclosure" to coordinate remediation and restoration.
The vulnerabilities: CVE-2026-109618 and CVE-2026-109619
The incident centers on two critical PHP vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. According to the National Cyber Security Centre (NCSC), the flaws could allow unauthenticated attackers to execute code on vulnerable servers—an outcome that drove the NCSC’s blunt advice: patch immediately or consider disconnecting affected systems until fixes are applied.
Baroness Lloyd also told peers: "We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," and extended that assessment to the wider UK public sector during the Lords exchange.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAI-assisted discovery and the security response
The discovery and disclosure chain is notable for the role of AI-assisted tools and the involvement of multiple private-sector researchers. Security firm Calif found one of the bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz uncovered both flaws with the help of AI tools. OpenAI subsequently "dug into the vulnerabilities itself and worked with vendors and government agencies to get the word out," Baroness Lloyd said, and she added that "the NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers."
The NCSC also sent 50,000 warnings to businesses and other organizations as part of the coordinated disclosure and alerting effort.
International ripple effects and observed exploitation
The precautionary response was not confined to the UK. Governments in Germany, France, Belgium, Finland and the Netherlands took websites offline, and Australia's cybersecurity agency website was also taken down as a safeguard. Across the Atlantic, the NSA urged organizations to patch or disconnect vulnerable systems; the US government has not publicly confirmed any federal website shutdowns.
Cloudflare reported "millions of attempts" to weaponize the flaws, and Amazon Web Services said attackers were exploiting the vulnerabilities four days before they were publicly disclosed—details that underscore the urgency behind the NCSC’s guidance and the precautionary removals of services.
What this means for technologists, policymakers, and the public
- Technologists and security teams: Expect intensive patch management and risk triage. The NCSC’s recommendation to patch immediately or take systems offline drove the precautionary outages in central and local government; teams will be under pressure to identify vulnerable PHP instances and apply mitigations rapidly.
- Policymakers and regulators: The incident sharpened scrutiny in the Lords about statutory duties. Liberal Democrat peer Baroness Ludford highlighted councils—Edinburgh, Oxford, Bristol, Lambeth and Barnet—whose services reportedly went offline, and she questioned why central government and local authorities remain outside the duties proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday.
- The public and service users: Users faced real, immediate disruption to government services—some entirely offline—because departments prioritized containment and repair over availability. The OBR’s outage ahead of a looming Budget illustrates the potential for operational consequences when precautionary shutdowns intersect with fixed scheduling and public-facing commitments.
The PHP2Shell episode combines rapid, AI-assisted discovery with a coordinated government response and large-scale, precautionary service outages. It also leaves a pressing procedural question on the table for lawmakers: should central and local government be brought explicitly within the statutory obligations that the Cyber Security and Resilience Bill will re-examine in the Lords on Monday? For now, Whitehall’s immediate task remains technical and operational—patch, mitigate, restore—and the NCSC’s 50,000 warnings and the cross-departmental incident response will be judged by how quickly public services can be returned to safe operation.
