Thirty-two UK government services are offline and four are partially unavailable while work is carried out to address a critical security flaw in PHP, Tech Minister Baroness Lloyd of Effra told the House of Lords on Thursday, PA Media reported.

Source: PA Media via AJ Bell

She said the outages had "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied."

32UK government services unavailable
4services partially unavailable
~70%of websites use PHP, Cloudflare says

Downing Street said no large public-facing critical services had been affected, but some limited government websites had gone dark while the issues were resolved. A No 10 spokeswoman said work had already taken place across government to identify and fix potential exposures, and added: "But this does not mean they were hacked, and work continues to resolve any issues."

Experts at the National Cyber Security Centre (NCSC) are working with OpenAI — whose technology was used to discover the vulnerabilities — and with partners around the globe, the spokeswoman said. Lady Lloyd told peers the NCSC was briefed by OpenAI on the vulnerability last week and the government acted proactively ahead of public disclosure.

The NCSC warned UK organisations on Wednesday that a critical security issue had been discovered in PHP, which the cybersecurity firm Cloudflare says is used by almost 70% of websites. The NCSC has urged organisations to update to a new, fixed version of the PHP software, or consider taking their websites offline if they cannot be upgraded immediately.

What is solid

  • 32 UK government services are unavailable and 4 are partially unavailable, the tech minister told the House of Lords
  • Downing Street says the outages are largely precautionary and do not mean the services were hacked
  • The flaw is in PHP, used by almost 70% of websites according to Cloudflare

What is only claimed

  • Which specific services are affected — the government has not named them, saying a list is not standard practice
  • Whether any system was actually breached — officials say there is no sign the outages mean a hack took place

The UK count is the latest fallout from the global emergency patch race that began when the PHP flaws were disclosed. Read the earlier PHP2Shell story

(Sources: PA Media reporting, via AJ Bell and Business Matters Magazine, 22 October 2026; Downing Street and NCSC statements reported by PA Media.)