PHP2Shell Vulnerabilities Cause Outages in UK and EU Government Services

Critical vulnerabilities in PHP, known as PHP2Shell, have led to widespread disruptions in the operation of government services. The UK's Minister for Technology admitted that due to these errors, 32 government services were completely shut down, while another 4 are experiencing intermittent outages.

The vulnerabilities allow attackers to execute arbitrary code on the server without any authentication. Websites were primarily taken offline preemptively while security patches were being installed. The government has not published a full list of affected agencies.

Among the affected resources were websites of the Office for Budget Responsibility, the Driver and Vehicle Licensing Agency (DVLA), and police services. Disruptions were also observed in the city councils of Edinburgh, Oxford, Bristol, and two London boroughs.

• Office for Budget Responsibility website, taken offline days before the budget publication
• Driver and Vehicle Licensing Agency and police services
• City councils of Edinburgh, Oxford, Bristol, and London boroughs

The incident had a global scope: government sites were also taken offline in Germany, France, Belgium, Finland, and the Netherlands. According to AWS, hackers began exploiting these bugs four days before their public disclosure. Cloudflare has already recorded millions of attack attempts.

In Russia, the FSB has issued directives to government bodies, banks, telecommunications, energy, transport, and medical companies. They are required to update PHP, check servers for signs of compromise, and if immediate updating is impossible, restrict access up to disconnecting systems entirely.