UK Government Warns of Temporary Service Disruptions After Global PHP Security Alert

Key points

• Downing Street says some UK government services could temporarily go offline amid a global cybersecurity response.
• Officials say no large public-facing critical services are being affected.
• Two critical PHP vulnerabilities prompted urgent security updates and warnings to organisations worldwide.
• The incident highlights how a flaw in software running behind websites can disrupt services far beyond the technology industry.

LONDON, October 22, 2026

The UK government has warned that some online services could temporarily become unavailable as authorities respond to a global cybersecurity alert involving two critical vulnerabilities in PHP, a programming language widely used to run websites and applications. Downing Street said no large public-facing critical services were being affected, although some limited services could be taken offline temporarily as a precaution.

The warning follows emergency security updates released by PHP developers on October 21. The UK’s National Cyber Security Centre (NCSC) has urged organisations to identify affected systems, install the fixes and consider taking vulnerable systems offline if they cannot be secured promptly.

Why the PHP security alert matters

PHP operates behind the scenes on websites, helping servers generate pages, process requests and communicate with databases. Because it is embedded in a wide range of websites and other software products, a vulnerability in PHP can affect organisations that may not realise they rely on it.

The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious code remotely on vulnerable servers without authenticating first. Depending on the system and the circumstances, successful exploitation could expose sensitive information or give attackers control over server operations.

The European Union Agency for Cybersecurity (ENISA), the European Commission and other European cybersecurity bodies have urged organisations to act immediately, prioritising systems accessible from the internet.

The response has already affected online availability in several countries. Reuters reported that government websites in Europe and elsewhere went offline on October 21 as administrators worked to protect their systems. Temporary shutdowns in this situation are a security measure, not proof that the affected organisations have been hacked.

AI discovery brings a new dimension to cybersecurity

The incident is also drawing attention to the growing role of artificial intelligence in finding software vulnerabilities.

OpenAI said on October 21 that its AI-assisted research initiative helped identify one critical flaw, while cybersecurity company Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the development and release of the security fixes, with researchers and technology partners helping coordinate the response.

The development illustrates both the potential and the limits of AI-assisted security research. AI tools can help researchers uncover weaknesses that might otherwise remain undetected, but identifying a flaw is only one part of protecting systems. Software maintainers must validate the finding, develop a reliable fix and give organisations enough information to deploy it.

In this case, the PHP Foundation acknowledged that early signs of one flaw had been identified in 2024, but the issue was not addressed at that time because researchers had not established a concrete exploitation method and other issues appeared more pressing. The foundation described the delay as a structural failure, Reuters reported.

That history highlights a difficult problem for the software industry: a weakness can exist for years before its practical security implications become clear.

What organisations need to do now

The NCSC recommends that organisations identify all systems running PHP, prioritise internet-facing infrastructure and update to the latest fixed version. Businesses that cannot update immediately should follow the PHP Foundation’s mitigation guidance and consider taking exposed systems offline if adequate protection cannot otherwise be applied.

Organisations should also review third-party products that may bundle PHP, rather than checking only websites they know were built directly with the language. The NCSC warns that teams unable to update or disable a system immediately should assess it for signs of compromise before applying remediation.

For the public, the distinction between precautionary downtime and a confirmed cyberattack is important. A temporarily unavailable government webpage does not necessarily mean personal data has been stolen or government systems have been breached.

Downing Street’s assurance that large public-facing critical services were not being affected is therefore significant, but it does not mean every government website or digital service is guaranteed to remain available throughout the response.

The immediate priority is to close the vulnerabilities before they can be exploited. The broader challenge is ensuring that organisations across the public and private sectors can identify hidden software dependencies and respond quickly when a weakness in widely used technology threatens services on a global scale.