Major Cyber-security Incident Hits Government Websites

By the Editorial Team · Friday, October 23, 2026

A vulnerability in the PHP programming language caused over 30 UK government websites, including the Judiciary and Scottish Parliament, to go offline temporarily as officials worked to apply security patches. Authorities confirmed no critical systems were breached, but the incident highlighted the widespread risk posed by the flaw and prompted calls for urgent updates to prevent potential cyberattacks.

A significant cyber-security incident disrupted numerous government websites yesterday, causing a temporary shutdown of more than 30 online services. According to officials, 32 government websites were taken offline and an additional four were partially inaccessible as authorities worked to address the issue. The incident prompted precautionary measures but did not compromise any critical public services, Downing Street confirmed.

Among the affected sites were those belonging to the Judiciary, Food Standards Agency, Environment Agency, Competition and Markets Authority, Gambling Commission, and the Scottish Parliament. Most had been restored by the afternoon. The Office for Budget Responsibility preemptively removed its website from the internet amid concerns that sensitive information related to the upcoming national Budget might be exposed. Several local council websites, along with the online reporting platforms of Thames Valley, Northumbria, and Northern Ireland police forces, also experienced downtime.

The disruption extended beyond government domains; garages nationwide temporarily reverted to manual record-keeping for vehicle MOT tests when the Driver and Vehicle Standards Agency’s (DVSA) website became unavailable.

The underlying cause was traced to a vulnerability in PHP, a widely used programming language that supports over two-thirds of internet websites—estimated at around 30 million globally. Cyber-security firm Calif detected the flaw using technology developed by OpenAI, and the PHP Foundation swiftly issued a security patch to address the problem.

The U.S. National Security Agency (NSA) advised website operators to take their systems offline until the patch was applied, warning that the vulnerability could allow attackers to access confidential data or install malicious software, potentially facilitating ransomware attacks.

Baroness Lloyd of Effra, the technology minister, characterized the shutdowns as precautionary and emphasized that no government systems had been compromised. Efforts are ongoing to ensure all affected sites implement the necessary updates to prevent future exploitation.

This article was reported by synthesizing coverage from multiple independent news outlets to present a balanced, unbiased account. Read about our editorial standards. Spotted an error? Let us know.