Government takes 32 services offline as 'millions of sites impacted by PHP vulnerabilities'

Government takes 32 services offline as 'millions of sites impacted by PHP vulnerabilities'

The United Kingdom has taken 32 government services offline and left four more partially unavailable after security researchers uncovered a critical vulnerability in the PHP scripting language used by nearly 70 percent of websites. The flaw allows remote code execution, meaning attackers could run their own code on affected servers, steal data, or plant backdoors for later access. The vulnerability affects all PHP installations serving web requests and dates back to PHP version 5, released more than twenty years ago in 2004. Cloudflare reported millions of exploitation attempts within hours of the flaw being publicly disclosed, with attacks beginning roughly ten hours before the announcement. No large public-facing critical services have been affected, and officials confirmed that next week's government budget security has not been compromised. The PHP Foundation has issued patches for supported versions and warns that updating is the only safe choice, with no complete mitigations available.