Websites taken offline across UK & Europe as ‘critical’ security flaw hits dozens of government sites

A wide mix of public websites and online services were affected by weaknesses in PHP, software used behind many websites. The disruption mattered because it reached public authorities, police, entertainment services, gaming, cloud storage and website-building platforms.

The affected services included the Met Police website, Edinburgh and Oxford council websites, and the online home for The Traitors. Steam, Google Drive and WordPress were reported down, while Bristol, Lambeth and Barnet council websites displayed error messages. Finland temporarily shut down government public web services.

The Netherlands' cyber-security agency also took its website offline. These actions showed that organisations were limiting exposure while waiting for protection. The article does not provide a complete list or an exact number of affected websites. It says the vulnerabilities affected PHP and could reach sites built with popular platforms such as WordPress.

PHP is software that works behind the scenes to keep websites running. Websites use it to process instructions and deliver pages or features to visitors. The article identifies PHP as the software affected by the flaws and says it supports websites built using popular platforms such as WordPress.

WordPress is a widely used website platform, and PHP helps power its operation. That connection explains why the warning extended beyond one organisation or one website. The article reports that WordPress was among the online services affected, alongside councils, police services and other platforms.

The risk mattered because the flaws could allow hackers to run their own commands on vulnerable systems without logging in. Full details of the flaws and affected versions had not yet been published. Website owners therefore faced uncertainty while waiting for emergency software updates and considering whether to take systems offline.

There is no precise total in the article. Instead, it shows the breadth of the disruption by naming different kinds of organisations and services. These include local councils, a police website, national government web services, a cyber-security agency, online gaming, cloud storage, entertainment and website publishing.

Examples include Edinburgh, Oxford, Bristol, Lambeth and Barnet councils, plus the Met Police website. Steam represented online gaming, Google Drive represented cloud storage, and WordPress represented a website platform. Finland's government services and the Netherlands' cyber-security agency added national public-sector examples.

The article therefore supports at least eight broad categories, but that is a classification rather than an official count. It also says a raft of local authority websites was affected. Because full details of the flaws and affected versions were not published, the final scale remained unclear.

The most serious warning was that hackers might run their own commands on vulnerable systems without needing to log in. In simple terms, the flaw could give an unauthorised person a way to make the affected computer carry out instructions.

This risk came from weaknesses in PHP, the software working behind many websites. The article says European cyber officials warned about this capability, but it does not describe exactly which commands could be run or what damage would follow. It also says the affected versions and full flaw details had not yet been published.

That uncertainty made the vulnerability difficult to assess for individual website owners. Organisations had to prepare for emergency updates and consider taking systems offline if immediate remediation was not feasible. Leaving a vulnerable system connected could expose it to attackers before a fix was installed.

Some organisations took websites offline because they could not immediately apply a fix. Disconnecting a vulnerable service reduced the chance that hackers could exploit the weakness while the organisation waited for protection. This was a defensive choice, even though it temporarily stopped public access.

The National Cyber Security Centre warned that organisations should consider taking systems offline when immediate remediation was not feasible. Finland temporarily shut down the government's public web services, and the Netherlands' cyber-security agency took its own website offline because of the vulnerabilities.

Emergency fixes were due at 3pm BST on Wednesday, October 21, although they could arrive earlier. Until those updates were available and installed, leaving a vulnerable website online could create greater security risk. The article presents going offline as a temporary measure until systems could be fully mitigated.

The UK's National Cyber Security Centre responded by urging UK organisations to prepare for emergency software updates. It warned that organisations should consider taking systems offline when immediate remediation was not feasible. This gave website owners practical guidance while fixes were still pending.

European cyber officials highlighted the central danger: the weaknesses could let hackers run their own commands on vulnerable systems without logging in. The warning added urgency, even though full details of the flaws and affected PHP versions had not yet been published. Finland temporarily shut down government public web services.

The Netherlands' cyber-security agency said it was taking its own website offline because of the vulnerabilities. These agencies therefore combined warning, preparation and risk reduction. Their response focused on limiting exposure until software fixes became available and systems could be fully mitigated.

Software updates and security patches protect a website by correcting the code or settings that contain a known weakness. Once installed, the vulnerable software should no longer respond to the attack method identified by security teams. Updates can therefore prevent attackers from using the flaw to run commands.

In this case, emergency fixes were being prepared for PHP. Website owners needed to apply those fixes to systems using affected versions, including some sites built with WordPress. The article says the fixes were due at 3pm BST on Wednesday, October 21, although they could arrive earlier.

A patch is useful only when organisations install it and fully mitigate the affected system. Until then, the NCSC advised considering taking the system offline where immediate remediation was not feasible. The article does not explain the patch's technical design, so this general explanation uses established cybersecurity knowledge.