Locks and Security News: your weekly locks and security industry newsletter
28th October 2026 Issue no. 825
Your industry news - first
We strongly recommend viewing Locks and Security News full size in your web browser. Click our masthead above to visit our website version.
PHP flaws take 32 UK government services offline
Organisations are racing to update their systems after critical vulnerabilities were found in PHP, the programming language that powers a large share of the web. Websites around the world were taken offline on Wednesday 21st and Thursday 22nd October as a precaution.
The UK government was among those affected. Tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four partially unavailable, largely due to precautionary measures while security updates are applied. The government says this does not mean systems were hacked.
The flaws are serious enough that attackers could use them to take control of a website’s server without needing a password. They had gone unnoticed for more than a decade and were uncovered with the help of AI tools.
The developers of PHP have released urgent security updates and are urging all users to install them immediately. PHP says updating is the only way to be fully protected. Organisations using older, unsupported versions have been warned to take affected systems offline until they can be secured.
No successful attacks have been reported so far, but experts say the impact may take months to become fully clear. Olly Whitehouse, chief technology officer at the National Cyber Security Centre, called the event “unprecedented” and said there were “no indications” of successful breaches.
Simon Edwards, CEO of SE Labs, commented: “Forced disclosure has changed the cyber security culture for the better. The way organisations respond to cyber threats has changed dramatically. Where businesses once hid or denied breaches out of fear or embarrassment, there is now more recognition in the importance of sharing information to help others defend themselves. Currently, we’re seeing another shift. Organisations are taking services offline when there is no effective way to mitigate a serious threat quickly enough.”
“Taking systems offline may seem drastic, but it can be the responsible choice when the alternative is being exposed to an attack. The priority must always be to protect users and critical systems, with rigorous security testing helping organisations identify weaknesses and make informed decisions before threats escalate.”
The scale of disruption reflects how widely PHP is used, with services across the globe choosing to go offline temporarily rather than risk exposure while patches were applied. For many organisations, how long they stay offline depends on whether they know what they are running.
Sawan Joshi, Group Director of Information Security at FDM Group, also commented: “To mitigate the risks of incidents like these, it’s important to broaden your understanding of asset management. Knowing your risk exposure in this area means to know your software, your vendors’ software and the tooling used to build your architecture.”
“This ensures you’re less reactive and able to maintain a front-footed patch management programme where in the case of PHP, you’re able to roll out the patch, and implement the necessary safeguards, fast. It’s those moments where clear decision making can only happen if software, its purpose, and engineering are explainable.”
28th October 2026