32 government services offline. What it means for your website.

What's happened

On 22 October, tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four more partly unavailable, because of the PHP2Shell flaws in PHP, the software behind WordPress and most business websites. Reports named websites including the judiciary, the Food Standards Agency, the Environment Agency and the Scottish Parliament among those affected.

The minister said the outages had "largely resulted from precautionary measures taken to protect systems while security updates and mitigations are applied". Downing Street was clear that "this does not mean they were hacked", and said no major public-facing critical services were affected.

The same day, the National Cyber Security Centre's chief technology officer, Ollie Whitehouse, told ITV News: "We've issued over 50,000 warnings to organisations in the United Kingdom." The NCSC has described the issue as an "extremely serious risk".

If you missed the background, PHP2Shell is a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker take over a web server without logging in. Fixes came out on 21 October, and attacks started within hours. Here's our full explainer.

Why the government switching things off matters

The NCSC's advice has been the same from day one: patch straight away, and if you can't, consider taking the affected system offline until it's fixed. The government has now taken its own advice, on its own services, in public.

That's a useful signal. If the people with the most security staff in the country decided a day or two offline was a better bet than leaving an unpatched website running, it's a reasonable call for your business too. A website that's offline for a day is an inconvenience. A website that's been taken over can steal what your customers type into it, send spam in your name, or give an attacker a route into the rest of your systems.

What this means for your business

Most businesses don't run their own web servers, so the fix is usually in someone else's hands: your web host, your web developer, or the agency that built the site. The risk is that everyone assumes someone else has done it. Three things to do, ideally today:

1. Check whether your website is patched. Ask your host or developer directly: "Is the PHP on our website updated to a version that fixes PHP2Shell?" If you can find out your PHP version, my free PHP2Shell checker tells you whether it's fixed. It runs in your browser and doesn't send anything anywhere.
2. Look for anything odd. New admin users, files you don't recognise, pages redirecting somewhere strange, or warnings from Google. If you see any of these, treat it as a cyber incident, not just a patching job.
3. Make sure warnings can reach you. The NCSC's free Early Warning service alerts UK organisations when something it sees affects their internet addresses. It takes a few minutes to sign up, and it's exactly the kind of alert you'd want in a week like this.

The bigger lesson

Websites are easy to forget. They're built once, handed over, and nobody's quite sure who keeps the server updated. This week, that question suddenly mattered to 32 government services, and to tens of thousands of UK organisations.

Keeping software up to date is one of the five Cyber Essentials controls, and that includes the server your website runs on. If your answer to "who patches our website, and how quickly?" is a shrug, write the answer down this week and agree it with whoever looks after the site. Next time, you'll be the business that patched on day one.

Sources

• ITV News: More than 50,000 warnings sent to UK organisations over 'extremely serious' cybersecurity threat
• LBC: Thirty-two Government services offline amid PHP cybersecurity issue
• The Register: PHP2Shell puts dozens of UK government services out of service
• NCSC: Critical security issue affecting PHP