Khaberni - A serious security vulnerability in the PHP programming language puts British government services to the test, after 32 services became unavailable and another 4 were partially affected.
The incident reveals the magnitude of risks facing the digital infrastructure and reopens the file on British institutions' readiness to counter cyber attacks amidst official warnings of shortcomings in government system protection and escalating cyber incidents.
The danger of the incident not only lies in the disruption of services but also extends to the broad scope of the threat. According to W3Techs data, a website specializing in web technologies tracking, PHP is used in about 70% of websites whose programming language can be identified.
With repeated attacks targeting British companies and institutions, gaps in the protection system are becoming evident, especially with continued reliance on old technological systems and existing security control shortcomings within ministries, according to the British National Audit Office.
According to a recent report published by The Record, citing a yearly assessment by the London Police, the reported losses from hacking crimes and cybercrimes that rely directly on digital systems amounted to 14.3 million pounds during the fiscal year 2025-2026, an increase of 90% compared to the previous year.
The reported losses via various fraud categories, including fraud using digital means, amounted to 3.2 billion pounds during the same period.
How did the crisis begin?
The crisis began with the discovery of two serious security vulnerabilities in PHP, which, under certain conditions, allow for memory exhaustion leading to damage that may enable attackers to execute remote code on web servers without authentication.
The British newspaper «The Telegraph» clarified that the two vulnerabilities could expose websites and their users to hacking risks. At the same time, Wiz, a company specializing in cybersecurity, warned of their danger, considering them among the most serious vulnerabilities discovered in PHP, and perhaps in software history.
According to «Reuters», PHP developers have issued patches to address the vulnerabilities, while cybersecurity officials in the European Union urged institutions that are unable to apply the fixes to temporarily shut down affected sites as an alternative to leaving them exposed to risks.
The dangers of the vulnerabilities lie in the prevalence of the language they target, as W3Techs mentioned that it is used in about 70% of websites whose programming language can be identified, and it fundamentally supports the content management system «WordPress», which powers about 40% of all websites, according to «Reuters».
The vulnerabilities have been ranked at a level of 9.2 out of 10 on the CVSS v4.0 scale for security vulnerability severity, reflecting the potential for executing commands on the infected server over the internet without needing a password, which could pave the way for data theft, content alteration of websites, or control over affected systems.
What happened in Britain?
In Britain, the risks associated with the vulnerability led institutions to temporarily shut down their websites, including local councils in Edinburgh, Oxford, and Bristol, according to «The Telegraph».
The British National Cyber Security Centre urged institutions to immediately update their systems using PHP, update to supported versions that include security fixes, and consider shutting down systems that cannot be repaired promptly.
In an interview with «World at One» on BBC Radio 4, Ollie Whitehouse, the technical director for the National Cyber Security Centre, mentioned the unprecedented scale of the problem, warning that its effects would be widely felt.
This incident clarifies that the spread of technology does not guarantee its safety, and a vulnerability in a widely-used software component could become a shared weakness among many institutions. However, it does not necessarily mean the hacking of all websites using PHP; the level of risk depends on the versions used, system settings, and the speed of implementing the fixes.
What is the magnitude of the risk?
These developments come at a time when British regulatory bodies warn that the government's ability to withstand cyber attacks is still below the required level, and progress in addressing vulnerabilities is slow despite escalating threats.
The British National Audit Office, in its report on the government's cyber resilience, concluded that protection levels and capability to withstand attacks are lower than previously estimated, with substantial gaps in system controls within ministries, which are essential elements for data protection and ensuring the continuity of public services during an attack.
The report highlighted that ministries continue to rely on hundreds of old technological systems, likely less capable of resisting modern attacks, in addition to lacking fully funded contingency plans for about half of the old systems at risk.
The office warned that these gaps threaten the government's ability to achieve its goal of making its critical functions resilient to cyber attacks.
Data from the British National Cyber Security Centre further illustrate the increased pressures. In 2025, the Incident Management Team at the center received 1727 notices about potential incidents, 429 of which required direct support from the team.
The center noted that incidents classified of national importance reached 204 incidents, representing 48% of the total incidents handled by the team, compared to 89 incidents the previous year. Additionally, 18 incidents, representing 4% of the total, were classified within the category of highly significant incidents, a nearly 50% increase, marking a trend that continued for the third consecutive year.
This data reflects that the challenge does not only relate to the number of hacking attempts but also the severity of the incidents and their ability to disrupt institutions and services of national importance.
What are the most threatened institutions?
The risks are not limited to government institutions but extend to the business sector and charities. According to the British Cyber Security Survey for the year 2025-2026, published on the British government's website, 43% of companies and 28% of charities reported being subjected to a cyberattack or breach over the twelve months prior to the survey.
This percentage translates to about 612,000 companies and 57,000 charities in the United Kingdom, according to the government survey. It was estimated that 19% of companies and 14% of charities had experienced at least one cybercrime, equivalent to about 267,000 companies and 28,000 charities.
The data reveals variations in exposure levels depending on the size of the institution, with 65% of medium-sized companies having been attacked or breached, compared to 69% of large companies, versus 42% for micro-enterprises and 46% for small companies.
Phishing attacks remained the most common, with 38% of companies and 25% of charities having been targeted, according to the survey. The report estimated that British companies faced about 5.19 million cybercrimes of various types over a year, including nearly 70,000 crimes not related to phishing, while charities faced about 525,000 electronic crimes.
This data indicates the broad scope of the threat, as it includes various types of attacks and attempts at fraud and hacking.
What about previous attacks and the scale of losses?
Attacks on British companies and institutions during 2025 provide examples of outcomes that can arise from protection shortcomings or delayed responses. Crowe's report, a British company specializing in audit, consulting, risk management, and cybersecurity, showcases some of the most significant incidents.
In April 2025, «Marks & Spencer» was targeted by a ransomware attack, attributed to the cybercrime group «Scattered Spider». The attack led to the halt of online sales, which were generating about 3.8 million pounds daily, and a disruption of inventory management systems. Analysts estimated a drop in the company’s market value by about 700 million pounds.
In November 2025, the shared technical infrastructure of three local councils in London, Kensington and Chelsea, Westminster City, and Hammersmith and Fulham, suffered a cyber attack resulting in data leaks and disruption of housing, benefits, and tax services for weeks. This incident sparked investigations and concerns about data protection, revealing risks associated with relying on a shared digital infrastructure without adequate separation of systems and data.
In another case, on August 31, 2025, «Jaguar Land Rover» was hit by a cyberattack that halted manufacturing operations for 5 weeks.
The attack led to a 27% reduction in car production in Britain, disruptions in the supply chain, and estimated financial losses of about 1.9 billion pounds, with thousands of workers in the supply chain laid off temporarily.
Another instance in October 2025 saw the British Information Commissioner's Office impose a fine of 14 million pounds on «Capita» due to a breach that occurred in 2023, affecting data of 6.6 million people, according to Crowe. The report explained that the delay in isolating an infected device, despite detecting the attack within about 10 minutes, allowed attackers to move within the network before leaking about a terabyte of sensitive data and deploying ransomware.
These incidents reveal that the implications extend beyond financial losses to disruptions in production and services, citizen data leaks, institutional reputation damage, job threats, and supply chain issues.
Is the British government ready to respond?
Reports from the National Audit Office and the National Cyber Security Centre, alongside British government data and incidents, indicate that Britain faces challenges in fortifying its digital infrastructure. These include updating old systems, managing access rights, quickly responding to incidents, and protecting technical supply chains.
As the reliance on digital services continues to manage government, economic, and everyday transactions, delays in addressing vulnerabilities could reflect on citizens’ and businesses’ ability to access services, in addition to risks of data leaks and disruptions in economic activities.
