Thirty-two UK government services were unavailable and four others partially unavailable amid emergency work to address critical vulnerabilities in the PHP programming language, a minister told the House of Lords on Thursday 22 October.
Baroness Lloyd of Effra, responding to questions in Parliament, said the disruption had largely resulted from precautionary measures while security updates and other protections were applied. Departments were working to restore services safely, she said.
Minister confirms extent of disruption
In a House of Lords exchange recorded in Hansard, the minister confirmed that 32 services were unavailable and four partially unavailable at the time of the statement. The figures describe the position reported to Parliament on 22 October and should not be assumed to represent the current number of affected services.
The minister said government departments had been warned before the vulnerabilities were publicly disclosed, allowing them to identify potentially affected systems and prepare mitigations. The Government Cyber Coordination Centre and the National Cyber Security Centre (NCSC) were coordinating the response.
Critical PHP security flaws
The NCSC issued an alert on 21 October concerning two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, the flaws could permit unauthenticated remote code execution on affected servers.
The NCSC advised organisations to identify their PHP installations, apply fixed software releases and consider temporarily taking systems offline where immediate remediation was not possible. It also recommended checking for evidence of compromise where updates could not be applied promptly.
No confirmed central government compromise
Baroness Lloyd told peers that, although scanning and exploitation activity had been reported internationally, the government was not aware at that point of any confirmed compromise of central government systems arising from the vulnerabilities. The distinction matters: taking a service offline to protect it does not establish that it was successfully hacked.
Downing Street also said that no large public-facing critical services had been affected, while acknowledging that some limited services could be temporarily unavailable. The government had not published a comprehensive list of the affected services.
Questions over public-service resilience
Peers questioned the impact on people relying on government websites and whether the public sector should face stronger statutory cybersecurity duties. Ministers said they were working with departments to restore availability after remediation and would continue to assess the wider resilience framework.
The incident highlights the practical consequences of a widely used software vulnerability for public services, even where systems are deliberately suspended to prevent a security breach.
Sources: House of Lords, Hansard, 22 October 2026; NCSC, critical security issue affecting PHP, 21 October 2026.