Race to update services' computer systems after cyber-security flaw found

Websites around the world were taken offline on Wednesday and Thursday after the developers of PHP said "critical vulnerabilities" were found in the back-end language, used in web development for decades.

Researchers warned the "severe" flaws could expose millions of sites using it to potential hacks if left unpatched - and the UK government was among those to take some sites offline as a precaution.

Downing Street said on Thursday "some" limited government services "may be offline" while security work was being carried out.

"The information I have is that 32 Government services are unavailable and four are partially unavailable," tech minister Baroness Lloyd of Effra told the House of Lords.

The government did not specify which services were taken offline - but it said no large UK public-facing critical services had been affected.

A spokesperson said work had already taken place across government to "identify and fix potential exposures to our systems and our experts are continuing to work closely with both OpenAI and international partners on this issue".

Olly Whitehouse, chief technology officer of the National Cyber Security Centre (NCSC), called the event "unprecedented".

But he said there were "no indications" of any successful breaches by hackers.

He said the NCSC was "starting to see positive confirmation" that advice sent to those affected, external had been received and was being acted on.

"Hacking has been around for many years," he said.

"The government are the ones who set the rules for other organisations... they just need to effectively be practising what they're preaching at this point."

He said his computer system had been down since Wednesday morning, and while he has experienced outages before, they have not lasted this long.

"MOTs can be conducted and they're legal but none of the paperwork and certificates can be printed and they're not on the system," Dean said.

It's a programming language which runs on a web server, behind the scenes of a website, and effectively lets you see the sites you visit.

It was developed in the early 1990s to help serve dynamic web pages and applications, but still powers lots of platforms today.

PHP has been used across a wide range of platforms including Wikipedia, online shops and WordPress – the system behind many websites - as well as to write tools to build web apps, with Laravel, Symfony and Drupal among popular PHP frameworks.

And it said the flaws - now coined "php2shell" - were inherent in the language itself, affecting many past versions of it.

The PHP Foundation, the non-profit which maintains the programming language, warned this meant that, under the right conditions, an unauthenticated attacker would be able to remotely execute code on servers running PHP.

Matthew Prince, the boss of internet infrastructure firm Cloudflare, wrote on X, external on Thursday that the company saw "thousands" of attempts to exploit the PHP vulnerabilities across its network in the 10 hours before it was publicly announced.

Amazon also says it saw hackers attempt to exploit the flaws, but its websites were operating as normal.

While the impact of the PHP flaw remains to be seen, disruption continued for businesses and organisations after many sites were taken down on Wednesday.

The website of a Dutch agency specialising in cyber-security, Finland's government and parts of Wikipedia, taken temporarily offline, had returned to business as usual by Thursday.

But a number of sites appeared to have been taken offline on Thursday, as operators rushed to check if PHP might be running within their systems or if any patches were required.

According to some cyber-security researchers using scans to check servers at risk of the PHP vulnerability, the rate of organisations implementing patches - but not as quickly as might be hoped globally.

"A few years ago, attackers might have taken weeks to exploit a vulnerability. Now, it can be days or hours."

"Resilience depends on people as much as technology."