Critical PHP Security Flaw Takes 32 UK Government Services Offline

A critical security vulnerability affecting PHP, one of the world's most widely used web programming languages, has prompted urgent action across the UK government and private sector.

On 22 October 2026, the government confirmed that 32 services were unavailable and a further four were partially unavailable while security teams worked to address the vulnerabilities.

The disruption followed an urgent warning from the National Cyber Security Centre (NCSC), which advised organisations to update affected systems immediately or consider temporarily taking them offline.

Although the shutdowns have disrupted public services, officials stressed that they were largely precautionary and did not establish that government systems had been successfully compromised.

The incident highlights the challenges businesses face when critical software vulnerabilities emerge and the importance of maintaining effective cyber security and incident response procedures.

What Happened to UK Government Services?

On 21 October, the NCSC published an alert concerning two critical vulnerabilities affecting PHP, identified as CVE-2026-109618 and CVE-2026-109619.

PHP is a server-side programming language used to operate websites, manage dynamic content and interact with databases.

It underpins widely used platforms and applications, meaning a serious vulnerability can potentially affect organisations across numerous sectors.

Following the disclosure, government departments and other organisations began examining their systems and implementing security updates.

Speaking in the House of Lords on 22 October, technology minister Baroness Lloyd of Effra confirmed that:

• 32 government services were unavailable.
• Four additional services were partially unavailable.
• The disruption largely resulted from precautionary security measures.
• Government departments were working to restore affected services safely.

Organisations including local authorities and the Office for Budget Responsibility also temporarily restricted access to websites while reviewing potential exposure.

Downing Street confirmed that no major public-facing critical government services had been affected.

What Is the PHP Security Vulnerability?

The newly disclosed vulnerabilities concern how PHP handles certain memory-management operations.

According to the NCSC, the flaws can potentially allow an attacker to exploit memory corruption and execute unauthorised commands on a vulnerable web server.

The two vulnerabilities are:

• CVE-2026-109618: A memory-handling issue involving partially initialised internal request data.
• CVE-2026-109619: A vulnerability involving internal request information that may remain accessible after its associated memory has been released.

Under particular circumstances, exploitation could result in unauthenticated remote code execution.

This means an attacker may be able to execute commands on an affected server without first obtaining legitimate login credentials.

The potential consequences depend on the configuration of the system, its exposure and the access an attacker manages to obtain.

Successful exploitation could place confidential information, website operations and connected systems at risk.

The PHP project has released security updates addressing the vulnerabilities, with the NCSC advising organisations to move to supported, fixed versions.

Why the Vulnerability Matters for UK Businesses

The implications extend beyond government websites.

PHP is widely used in commercial websites, content management systems, online stores and other business applications.

An organisation may also rely on PHP indirectly through software supplied or maintained by a third party.

Consequently, businesses may need to examine not only their main website but also other internet-facing applications and systems.

Potential risks associated with an unpatched vulnerability include:

• Unauthorised access to web servers.
• Exposure of sensitive business information.
• Disruption to customer-facing services.
• Manipulation of website content.
• Compromise of connected applications.
• Financial losses resulting from prolonged downtime.

The existence of a vulnerability does not mean that every organisation using PHP has been attacked.

However, the widespread use of the technology means affected businesses should assess their exposure rather than assume their systems are secure.

Evidence of Attempts to Exploit the Vulnerability

Following public disclosure, cyber security organisations reported significant attempts to exploit the PHP vulnerabilities.

Amazon Web Services reported observing exploitation activity, while Cloudflare identified a substantial volume of suspicious requests targeting potentially vulnerable systems.

Such activity demonstrates the speed at which attackers can respond when information about a serious software weakness becomes publicly available.

However, attempted exploitation and confirmed compromise are different matters.

A suspicious request targeting a server does not necessarily mean the attacker successfully obtained access.

Determining whether an organisation has been compromised requires examination of relevant technical evidence.

This distinction is important when assessing the seriousness of an incident and deciding what remedial action is necessary.

What Should Businesses Do Now?

The NCSC has issued specific guidance for organisations using PHP.

Its recommendations include identifying affected systems, applying security updates and monitoring for evidence of suspicious activity.

Identify Potentially Affected Systems

Businesses should establish where PHP is used across their technology infrastructure.

This includes public-facing websites, applications and third-party products that may incorporate the language.

Particular attention should be given to systems accessible from the internet.

Apply Available Security Updates

Organisations should work with their internal IT teams or technology providers to install supported PHP versions containing the relevant fixes.

Where immediate updates are not possible, businesses should review the temporary mitigation measures published by the PHP project.

Consider Temporary Service Restrictions

If a vulnerable system cannot be updated or adequately protected, temporarily restricting access may be necessary.

Although taking a service offline can cause disruption, it may be preferable to leaving a critical vulnerability exposed.

Examine Systems for Suspicious Activity

Businesses unable to remediate immediately should consider whether there are indications that their systems have already been targeted or compromised.

Relevant evidence may include unusual server activity, unexpected changes to files, suspicious processes and unexplained network connections.

Cyber Incident Response and Evidence Preservation

Where an organisation suspects that a vulnerable system has been compromised, the response should extend beyond simply installing a software update.

Although patching can address the original vulnerability, it may not remove malicious software or unauthorised access mechanisms introduced before the update.

An appropriate investigation may need to establish:

• Whether the vulnerable system was accessible to attackers.
• Whether suspicious activity occurred.
• Which systems or applications may have been affected.
• Whether unauthorised access can be confirmed.
• Whether sensitive information may have been exposed.
• What further containment or recovery measures are required.

Preserving relevant logs and electronic evidence can assist in understanding the incident.

Conflict International's Cyber Security and Incident Response Services support organisations assessing suspected cyber incidents, identifying relevant indicators and determining appropriate next steps.

The objective is to distinguish confirmed findings from potential risks and provide an informed basis for further action.

The Wider Business Continuity Implications

The disruption to UK government services demonstrates that organisations can experience significant operational consequences even when security measures are implemented successfully.

Taking vulnerable systems offline may prevent immediate exposure, but it can also interrupt services relied upon by customers, employees and commercial partners.

For businesses, this creates an important operational consideration.

Cyber security planning should address both preventing compromise and maintaining essential activities when systems become temporarily unavailable.

Relevant preparations may include identifying critical applications, understanding third-party software dependencies, maintaining recovery procedures and establishing clear responsibilities for emergency security decisions.

Where an organisation relies heavily on external technology providers, it should also understand how security updates and emergency restrictions will be managed.

These considerations are particularly important for businesses handling sensitive information or delivering services that depend on continuous system availability.

Protecting Organisations Against Emerging Cyber Threats

The PHP vulnerability demonstrates how a weakness in widely used software can create immediate challenges across government and commercial environments.

It also highlights why cyber security cannot be treated as a one-off exercise.

Regular vulnerability assessments, appropriate software maintenance and clear incident response procedures help organisations identify weaknesses and respond when new threats emerge.

Conflict International supports UK and international organisations requiring cyber security assessments, digital investigations and incident response assistance.

Whether a business is concerned about a newly disclosed vulnerability or has identified suspicious activity within its systems, an appropriately scoped assessment can help establish the risks and available response options.

Contact Conflict International to discuss your cyber security requirements in confidence.