Minister reports 32 government services offline after PHP alert

A UK minister told peers on 22 October that 32 government services were unavailable and four were partly unavailable while security work addressed critical flaws in PHP, software widely used to run websites. Baroness Lloyd of Effra said the disruption had largely followed precautionary steps to protect systems while updates and other safeguards were applied. The figures describe the position reported to the Lords that day, rather than a verified count of services still offline now.

No confirmed central government compromise in the statement

The minister said the government was not aware of any confirmed compromise of central government systems resulting from the vulnerabilities. She urged small businesses using managed services to ask their provider whether the systems they rely on had been updated. The parliamentary record does not identify a particular Welsh service as compromised. Precautionary withdrawal of a website does not, by itself, establish that it was hacked.

Official advice for website operators

The National Cyber Security Centre’s UK-wide alert is relevant to organisations in Wales using PHP. The centre says security updates have been published for two vulnerabilities that could, under certain conditions, allow an attacker to run commands on a web server. Its advice is to identify systems using PHP, prioritise those exposed to the internet and apply the latest fixed version. That includes checking products and services which contain PHP, rather than looking only for software installed directly. Where an update cannot be applied, operators should follow the vendor’s temporary safeguards. If those cannot be applied promptly, the NCSC says to consider taking the system offline until it can be protected. Its full guidance is linked below.