PHP2Shell puts dozens of UK government services out of service

What happened

A minister told the House of Lords that 32 UK government services are down and four are only partly working. The shutdowns were mostly a precaution while security fixes are added. The problem is called PHP2Shell. It is made of two critical flaws that let an outsider run harmful code on a server without logging in.

Key numbers and facts

• 32 UK government services are unavailable.
• 4 more are partly unavailable.
• The NCSC sent 50,000 warnings to businesses and other organizations.
• Councils reportedly affected include Edinburgh, Oxford, Bristol, Lambeth, and Barnet.
• AWS says attackers were exploiting the flaws four days before public disclosure.

Some background

PHP is a common tool that builds many websites. When a flaw is found in it, many sites are at risk at once. Governments in Germany, France, Belgium, Finland, the Netherlands and Australia have also taken some websites offline as a precaution. The NSA in the US urged groups to patch or unplug weak systems, but no US website shutdowns were confirmed.

Why it matters

Government services help people every day, so outages affect real users. The story also shows how AI tools helped find these flaws. Some critics say central government and local councils are not covered by planned cyber laws, so they may be less protected. The minister said there is no confirmed compromise so far.

What to watch

• Whether the 32 offline services come back online safely.
• Whether a full list of affected services is published.
• How the Cyber Security and Resilience Bill changes, when it returns to the Lords on Monday.
• Whether any hacking is later confirmed.