Thirty-two UK government services are offline and four are partially unavailable while officials address a critical security flaw in the programming language PHP, tech minister Baroness Lloyd of Effra told the House of Lords today.
“The information I have is that 32 Government services are unavailable and four are partially unavailable,” Lady Lloyd said. She told peers this “has largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied”.
Downing Street said no large public-facing critical services had been affected, but some “limited” government websites had gone dark while the issues were resolved. A No 10 spokeswoman said it was not “standard practice” to provide a list of the services affected.
“Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue,” the spokeswoman told reporters.
“No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out. But this does not mean they were hacked, and work continues to resolve any issues.”
The National Cyber Security Centre (NCSC) warned UK organisations yesterday that a “critical security issue” had been discovered in PHP, which cybersecurity firm Cloudflare says is used by almost 70 per cent of websites. The NCSC has urged organisations to update to a new, fixed version of the software, or to consider taking their websites offline if they cannot upgrade immediately.
“Organisations of all sizes should follow NCSC guidance to protect their system,” the No 10 spokeswoman said.
According to the PA news agency, the flaw could allow attackers to remotely control any web server running PHP, which underpins platforms including WordPress and Magento.
Lady Lloyd said the NCSC was briefed by OpenAI on the vulnerability “last week” and that “the Government acted proactively ahead of public disclosure”. NCSC experts are working with OpenAI, whose technology was used to discover the vulnerabilities, and with partners around the world, according to No 10.
The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at cybersecurity company Calif, using an advanced AI model developed by OpenAI.
Exploitation attempts
Amazon and Cloudflare said many attempts to exploit the vulnerability were spotted within hours of its announcement. In an update on the Amazon Web Services security blog, the company said its threat intelligence team found the flaw was “now being broadly exploited in the wild”.
Matthew Prince, Cloudflare’s chief executive, said today the company had seen thousands of attempts to exploit the flaw in the 10 hours before it was announced, hundreds of thousands within two hours of the announcement and millions since.
PHP developers had reportedly planned a security update for today, but brought the release forward after details of their work leaked online.
Alan Woodward, a visiting professor of computer science at the Surrey Centre for Cyber Security, told BBC Radio 4’s Today programme that “the cat was let out of the bag rather earlier than it was supposed to have been”.
“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit,” he said.
“And the patch came out yesterday afternoon, luckily, the PHP Foundation issued one, so that’s why everybody’s scrambling to make sure that that’s in place,” he said.
Budget security
Scottish Secretary Douglas Alexander said the security of next week’s Budget had not been compromised, after being asked about leak risks because the Office for Budget Responsibility (OBR) had taken down its website.
“No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security,” Mr Alexander told Times Radio this morning.
He said Chancellor John Healey had “initiated new security protocols reflecting his experience in the Ministry of Defence” when he moved to the Treasury in the summer.
Last year, the OBR’s Budget analysis was mistakenly published online ahead of then-chancellor Rachel Reeves’s statement to the Commons, allowing early access to market-sensitive information.
