Skip to content
Sign in
↑Part of: PHP vulnerabilities affect Australian Signals Directorate website
Technology · Europe

Baroness Lloyd says PHP security work left 32 UK services unavailable

Baroness Lloyd of Effra told the House of Lords that 32 UK government services were unavailable and four were partly unavailable while officials addressed a critical PHP security flaw. Downing Street said no major public-facing critical services were affected and that some limited government websites had been taken offline during the work.

AI-assisted synthesis · Based on 10 outlets' reporting · Article text read from 5 of 10 outlets · 1 article captured only in partHow it's made

View timeline · 9 entries
10 outlets2 regionsLatest reporting 4 min readNo new reporting in 3 days
Coverage: Center OnlyL 1 · C 6 · R 0 · 3 unrated
Updat3 graphic: Downing Street
Updat3 graphic

What happened

Key facts

  • Baroness Lloyd of Effra told the House of Lords that 32 UK government services were unavailable and four were partially unavailable (per bmmagazine.co.uk, chroniclelive.co.uk, cornwalllive.com).
  • Officials were addressing a critical security issue in PHP, the programming language used by almost 70% of websites according to cybersecurity firm Cloudflare (per chroniclelive.co.uk, cornwalllive.com, dumbartonreporter.co.uk).
  • Downing Street said no large or critical public-facing UK services had been affected, while some limited government websites were temporarily taken offline (per bmmagazine.co.uk, chroniclelive.co.uk, dumbartonreporter.co.uk).
  • Baroness Lloyd or officials said precautionary measures, updates and mitigations accounted for the unavailability of government services (per bmmagazine.co.uk, dumbartonreporter.co.uk, aol.co.uk).
  • The government said its experts were working with OpenAI and international partners on potential exposures linked to the PHP issue (per bmmagazine.co.uk, cornwalllive.com, dumbartonreporter.co.uk).
  • A No 10 spokeswoman said the government does not routinely provide a list of affected services (per bmmagazine.co.uk, dumbartonreporter.co.uk, chroniclelive.co.uk).
  • A No 10 spokeswoman urged organisations of all sizes to follow National Cyber Security Centre guidance (per cornwalllive.com, chroniclelive.co.uk, dumbartonreporter.co.uk).
  • Scottish Secretary Douglas Alexander said he had received no indication of a breach of Budget security; aol.co.uk also said the Office for Budget Responsibility website was affected (per aol.co.uk).

The brief

Baroness Lloyd of Effra told the House of Lords that 32 UK government services were unavailable and four were partially unavailable while officials worked on a critical security issue in PHP.

The figures describe service availability; Downing Street said no large or critical public-facing services had been affected, although some limited government websites were taken offline during the work.

The government’s account links the outages to precautionary protections and technical remediation. dumbartonreporter.co.uk reports that Lloyd said the unavailability largely resulted from safeguards while security updates and mitigations were applied; aol.co.uk also attributes the disruption largely to precautionary measures. bmmagazine.co.uk reports Lloyd’s warning that service outages did not mean the systems had been hacked.

The sources do not identify the affected services individually: a No 10 spokeswoman said it was not standard practice to publish a list. The immediate technical issue was a critical flaw in PHP.

Cybersecurity specialists had warned UK organisations about it, according to chroniclelive.co.uk and cornwalllive.com, while bmmagazine.co.uk says officials were already identifying and fixing potential exposures. Cloudflare was cited in chroniclelive.co.uk, cornwalllive.com and dumbartonreporter.co.uk for an estimate that PHP is used by almost 70% of websites.

That broad use helps explain why the issue drew attention beyond government services, but the sources do not quantify the number of organisations affected. Downing Street said government experts were working with OpenAI and international partners on potential exposures.

Its spokeswoman also advised organisations of all sizes to follow National Cyber Security Centre guidance, a recommendation included by chroniclelive.co.uk and cornwalllive.com. dumbartonreporter.co.uk adds a specific account of exploitation attempts: a Cloudflare network post said it saw thousands of attempts to exploit the issue during the 10 hours before the vulnerability was publicly announced.

The coverage differs in emphasis on what the government’s statements establish. bmmagazine.co.uk directly reports Lloyd saying outages did not mean services had been hacked, and dumbartonreporter.co.uk also says officials made that point; chroniclelive.co.uk and cornwalllive.com focus on the service count, PHP risk and Downing Street’s reassurance about critical public-facing services. dumbartonreporter.co.uk and aol.co.uk describe the outages as precautionary, while bmmagazine.co.uk and the other reports primarily describe services as unavailable during work to address the flaw.

These accounts are compatible: services could be taken offline as a precaution without evidence in the reporting that they were compromised.

Budget security also entered the discussion. chroniclelive.co.uk and cornwalllive.com quote Scottish Secretary Douglas Alexander saying he had no indication of a breach of Budget security. aol.co.uk connects that assurance to the Office for Budget Responsibility website being affected. The available accounts do not say that the website’s disruption compromised Budget materials.

For organisations relying on PHP, the concrete next step stated by Downing Street was to follow National Cyber Security Centre guidance. The government said its experts were continuing work with OpenAI and international partners, while the unavailable and partly unavailable service counts show the operational footprint of the safeguards.

Why it matters

  • UK government service users faced disruption across 32 unavailable services and four with partial outages, although Downing Street said no large or critical public-facing services were affected.
  • Organisations using PHP—a language Cloudflare estimates is used by almost 70% of websites—were urged by Downing Street to follow National Cyber Security Centre guidance.
  • Government technical teams were applying updates and mitigations and working with OpenAI and international partners, making the response relevant to both public-service availability and potential exposure of systems.
  • Budget security was a specific concern because aol.co.uk says the Office for Budget Responsibility website was affected; Scottish Secretary Douglas Alexander said he had no indication of a breach.

What to watch next

  • Whether the government’s count of 32 unavailable and four partly unavailable services changes as officials apply updates and mitigations.
  • Whether the government names any of the affected services; a No 10 spokeswoman said the government does not routinely provide a list.
  • Whether government experts report further work with OpenAI and international partners on potential PHP exposures.
  • Whether the government or Scottish Secretary Douglas Alexander provides further information about Budget security and the Office for Budget Responsibility website.

How it's being covered

Coverage analysisShow details
10 source articles · 10 unique outlets · 8 distinct reports
Outlet political mix: Center Only· 1 Left · 6 Center · 3 unrated
Where the outlets are based: Europe 80% · US/Canada 10% · Other 10%
Outlet political mix
Center Only
Left
Center
Right
1 outlet
6 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 3 unrated outlets are not included.
Geography
Where the outlets covering this story are based.
10 unique outletsDominant coverage: Europe
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (6 of 7 rated sources); comparatively few Right-rated outlets have published on the event.
  • Coverage is currently concentrated among outlets based in Europe (8 of 10 geographically-identified sources).
How we measure coverage

How outlets' accounts compare

3 framing differences · 4 uncorroborated claims · 3 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 5 reports whose article text Updat3 read; 3 other outlets were checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • bmmagazine.co.uk and dumbartonreporter.co.uk explicitly say the outages did not mean government services had been hacked; chroniclelive.co.uk and cornwalllive.com emphasize the service outages and Downing Street’s statement that no critical public-facing services were affected.
  • dumbartonreporter.co.uk and aol.co.uk foreground precautionary measures as the reason for much of the unavailability, while bmmagazine.co.uk and chroniclelive.co.uk and cornwalllive.com mainly present the outages in the context of work addressing the PHP flaw.
  • aol.co.uk says the Office for Budget Responsibility website was affected, while chroniclelive.co.uk and cornwalllive.com report Alexander’s reassurance about Budget security without mentioning that website. The sources do not establish that the website disruption compromised Budget information.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • bmmagazine.co.uk and dumbartonreporter.co.uk report that the outages did not mean the services had been hacked; chroniclelive.co.uk and cornwalllive.com and aol.co.uk do not make that explicit claim.
  • Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four were partially unavailable.
  • A No 10 spokeswoman said organisations of all sizes should follow National Cyber Security Centre guidance.
  • Cloudflare said its network saw thousands of attempts to exploit the PHP issue during the 10 hours before public announcement, as reported by dumbartonreporter.co.uk.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not identify the affected government services or provide a count of successful intrusions.
  • The sources do not provide later service-availability figures or details about the duration of the outages.
  • The affected government services are not individually identified; a No 10 spokeswoman said it was not standard practice to provide a list.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. Rasmus Lerdorf created the tools that became PHP.
    Background · compiled and fact-checked by Updat3
  2. PHP made its first public release.
    Background · compiled and fact-checked by Updat3
  3. The PHP 3 release in 1998 established the language’s modern name and helped it become widely used for generating dynamic web pages.
    Background · from our historical context
  4. The UK established the Government Digital Service.
    Background · compiled and fact-checked by Updat3
  5. GOV.UK launched as the UK government’s central website.
    Background · compiled and fact-checked by Updat3
  6. The National Cyber Security Centre was established in October 2016 as part of GCHQ, providing a central UK institution for cyber-security guidance and incident response.
    Background · from our historical context
  7. The June 2024 CVE-2024-4577 response also showed that mitigation can involve more than installing a patch, because exposure depends on how PHP is configured and deployed.
    Background · from our historical context
  8. The closest precedent for emergency PHP security work was the disclosure of CVE-2024-4577 on June 6, 2024, a PHP-CGI argument-injection vulnerability affecting Windows servers.
    Background · from our historical context
  9. PHP released version 8.4.0.
    Background · compiled and fact-checked by Updat3

How we got here

The closest precedent for emergency PHP security work was the disclosure of CVE-2024-4577 on June 6, 2024, a PHP-CGI argument-injection vulnerability affecting Windows servers. PHP began in 1994 as tools developed by Rasmus Lerdorf and was released publicly as “Personal Home Page Tools” in 1995.

The PHP 3 release in 1998 established the language’s modern name and helped it become widely used for generating dynamic web pages. Its broad use across websites and server applications has made the security of PHP itself, and of software built with it, an operational concern for organisations running online services.

Original sources

1 of 10 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.