A cyber threat identified by tech researchers has left government bodies and multinationals as large as Amazon scrambling to build defences and stop hundreds of hacking attacks.
The UK government announced that dozens of services had gone offline as a precautionary measure to fend off cyber threats exposed by vulnerabilities in programming languages.
The Office for Budget Responsibility, which is in the process of preparing its crucial fiscal report for the Budget next week, was among those to announce late on Wednesday night that it had taken its website offline following advice from the National Cyber Security Centre. It was back up on Thursday and the body said the Budget had not been “compromised by security issues”.
Scottish Parliament, the Food Standards Agency, Environment Agency, Competition and Markets Authority and Gambling Commission also had websites taken down.
Baroness Lloyd of Effra, a digital minister, said a number of government services had been taken down in order to build security across the government.
“The government acted proactively ahead of public disclosure,” she said in the House of Lords.
“The government continues to monitor the situation closely and work with departments to maintain the security resilience and availability of public services.”
Researchers at security firms including Calif and Wiz identified flaws in PHP programming language that powers some of the largest websites and services in the world.
Cyber incident ‘exploited by hackers using AI’
Details of a solution to patch up software were “mistakenly” leaked online, according to a non-profit group involved in researching PHP, forcing engineers to share warnings publicly over the course of this week.
Wiz revealed it had used OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon to detect flaws.
The American company said: “These findings rank among the most severe vulnerabilities discovered in PHP and arguably in software history.”
OpenAI said in post that AI could be used to “help attackers rapidly develop offensive tools and exploits”.
Matthew Prince, the chief executive of Cloudfare, a cloud and network multinational, said there were “millions” of hacking attempts but none appeared to be successful.
Wikipedia was among those to shut down parts of its website while Amazon also said it had suffered hacking attempts.
Speaking before details of PHP issues emerged, AI minister Kanishka Narayan revealed that the government found some 500 new vulnerabilities in “significant areas of the public sector” after using a £13,000 model to identify problems.