Some 32 Government services are offline and four are partially unavailable amid the PHP cybersecurity issue, a minister told the House of Lords today.
asserted
minister → tell → Lords
Organisations around the world have been scrambling to fix a critical security flaw in the programming language PHP which is used by the majority of websites.
asserted
which → scramble → websites
Downing Street said earlier today that some 'limited' Government services may temporarily be offline while work is carried out to address potential cybersecurity issues – but no large UK public-facing critical services had been affected.
uncertain
services → say → issues
A No 10 spokesman told reporters: 'Work has already taken place across Government to identify and fix potential exposures to our systems, and our experts are continuing to work closely with both OpenAI and international partners on this issue.
asserted
experts → tell → issue
No large public-facing critical services are being affected by the exercise, but some limited services may temporarily be offline while security work is carried out.
uncertain
work → face → exercise
'But this does not mean they were hacked, and work continues to resolve any issues.'
The spokesman said it was not 'standard practice' to provide a list of Government services that were affected.
asserted
that → mean → services
Scotland Secretary Douglas Alexander has also insisted that the security of next week's Government Budget has not been compromised by the critical security flaw.
asserted
security → insist → flaw
The National Cyber Security Centre website warns of a critical security issue affecting PHP
He was asked whether the issues identified with PHP could result in major Budget leaks because the Office for Budget Responsibility (OBR) had to take down its website.
uncertain
Office → warn → website
It came after cybersecurity chiefs warned UK organisations yesterday that a 'critical security issue' had been discovered in PHP, which is used by almost 70 per cent of websites according cybersecurity firm Cloudflare.
asserted
which → come → Cloudflare
Mr Alexander told Times Radio this morning: 'No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security.
'
asserted
I → tell → security
Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.
asserted
he → understand → summer
Last year, the OBR's Budget analysis was mistakenly published online ahead of then-chancellor's Rachel Reeves statement to the Commons, allowing for early access to market sensitive information.
asserted
analysis → publish → information
Organisations have already been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the PHP software – or consider taking their websites offline if they cannot be upgraded immediately.
asserted
they → urge → websites
The security issue identified could allow attackers to remotely control any web servers running PHP, which underpins popular platforms such as WordPress and Magento.
uncertain
which → identify → WordPress
Many attempts at exploiting the vulnerability were spotted within hours of it being announced, according to Amazon and Cloudfare.
uncertain
it → exploit → Amazon
In an update published on the Amazon Web Services' security blog, the company said its threat intelligence team found the flaw was 'now being broadly exploited in the wild'.
asserted
flaw → publish → wild
Cloudfare chief executive Matthew Prince said today the firm spotted hundreds of thousands of hacking attempts within two hours of the announcement, with millions ongoing.
asserted
millions → say → announcement
In a post on X, Mr Prince said: 'In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it.
asserted
we → say → it
A programmer works with PHP code today at software firm RK Solutions in Guernica, Spain
'
asserted
programmer → work → Guernica
That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now.'
asserted
That → jump → hours
PHP developers had reportedly planned a security update today, but the release was brought forward after details of its work to address the vulnerabilities leaked online.
uncertain
details → plan → vulnerabilities
Speaking to BBC Radio 4's Today programme, Alan Woodward, a visiting computer science professor at the Surrey Centre for Cyber Security (SCCS), said: 'The cat was let out of the bag rather earlier than it was supposed to have been.
asserted
it → speak → bag
There was an embargo on this, and there's always a window between the flaw being publicly known about and it being patched so that the attackers can't successfully get in.
asserted
attackers → be → known
And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.
asserted
somebody → happen → bag
There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.
asserted
you → be → code
And that people like Amazon, Cloudflare, all sorts of companies that monitor what's going on on the web, saw that this was being probed for.
asserted
this → monitor → web
He added: 'We don't know whether it's being attacked, but certainly people were probing websites to see, have you got that flaw?'
asserted
you → add → flaw
The Wall Street Journal previously reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.
asserted
flaw → report → OpenAI
Professor Woodward explained the vulnerability had in fact already been identified by human researchers in 2024, but it was then believed exploiting this security flaw would be 'too complicated', and nothing was done.
asserted
nothing → explain → flaw
'What then happened was during this year, as the large language models became more and more effective at analysing these things, people worked out how to exploit it, and that's what's been happening in the last week behind the scenes,' Professor Woodward told BBC Radio 4.
asserted
Woodward → happen → Radio
'People have been scrambling away, saying, 'Well, actually, yes, you can exploit it, and we now need to patch it'.
asserted
we → scramble → it
'And the patch came out yesterday afternoon – luckily, the PHP Foundation issued one, so that's why everybody's scrambling to make sure that that's in place.
asserted
that → come → place
Meanwhile an outage affecting MOT testing services in the UK is understood to have been related to the PHP incident.
asserted
outage → affect → incident
The DVSA system, through which garages log their MOT records after testing vehicles, started experiencing issues yesterday afternoon until the issue was resolved this morning, according to the DVSA website.
uncertain
issue → log → website
Instead of filing information through the DVSA website, garages were instructed to use a paper system and upload the data at a later date, meaning tests could continue as normal during the outage.
uncertain
tests → file → outage
An update on the DVSA website late this morning said the incident had been resolved.
asserted
incident → say → website
The Aporia
