The UK government has said it is not aware of any successful compromises in the British public sector, or in the country more broadly, amid a worldwide push to patch critical security flaws in PHP, the programming language that underpins a large share of the web. Technology minister Baroness Lloyd of Effra made the statement in remarks carried by the BBC on Thursday, 22 October 2026, as reports of exploitation and scanning circulated internationally.
Her comments came as several outlets reported that websites around the world had been taken offline and that attackers were making millions of attempts to abuse the flaw. The BBC's live coverage described a global scramble to fix the issue, while The Guardian reported that sites across the world had been hit by large volumes of exploitation attempts.
Why it matters
PHP is decades old and remains deeply embedded in the infrastructure of the internet, which is why a serious flaw in it reaches far beyond any single company or country. When a weakness in such a widely deployed language becomes public, the pool of potential targets is enormous, and the window for defenders to act is short.
The minister's statement draws a line between activity observed elsewhere and confirmed harm at home. According to the BBC, Baroness Lloyd of Effra said the government had heard reports of exploitation activity and scanning internationally but was not aware of any compromises in the UK public sector or in the UK as such. That is a statement about what the government knows, not a guarantee that no British organisation has been affected.
What the minister is asking organisations to do
Rather than announcing new measures, the minister repeated a call for both the public and private sectors to strengthen their cyber resilience by adopting steps the government has already recommended.
Those steps, as she described them to the BBC, include registering for early warning systems, developing a full understanding of supply chains, and making sure that every link in those chains meets the required standards of cyber resilience. The emphasis on supply chains reflects a familiar problem in security: an organisation can be well defended itself and still be exposed through a vendor, contractor or hosted service it depends on.
The government's position, as set out in her remarks, is that resilience is something organisations must actively build rather than assume. She urged both sectors to take the measures "that we have suggested", according to the BBC.
A flaw drawing attention from multiple directions
The scale of concern is visible in the range of organisations publishing on it. The BBC ran live coverage of the response. CNBC framed the story around why governments chose to pull websites offline over a decades-old programming language. The Guardian reported millions of attempts to exploit the PHP code flaw against sites worldwide. The Register, meanwhile, reported that hackers were piling on to what it called PHP2Shell, and that Amazon Web Services had revealed attacks began before the flaw was disclosed.
That last point is significant in security terms: if exploitation started before public disclosure, then the period between discovery and patching was not the only exposure window. Defenders who moved quickly after the news broke may still have been reacting to activity that had already begun.
The National Cyber Security Centre also published an advisory describing a critical security issue affecting PHP. The BBC's reporting did not attribute specific technical details of the flaw, and CYBEV.io has not independently verified them.
Reading the official statement carefully
The minister's wording is precise and worth taking at face value. She referred to reports of exploitation activity and scanning internationally, and said the government was not aware of compromises in the UK public sector or in the UK as such. Scanning is often the precursor to attack rather than evidence of one; it indicates that systems are being probed and mapped.
The distinction matters for organisations trying to judge their own risk. A lack of confirmed compromises in the public sector does not mean private British organisations are unaffected, and the government's own advice points to the private sector as much as the public one. Nor does an absence of known incidents rule out incidents that have not yet been detected or reported.
What the minister offered was a resilience message rather than a technical one: know your suppliers, register for alerts, and hold those suppliers to a standard. For many organisations, the practical work in the coming days will be confirming which of their systems and third-party services run on the affected language, and whether those systems have been updated.
The BBC's coverage described many websites being taken offline, a step that removes exposure but also removes service. That trade-off is one reason governments and companies have been moving quickly, and it is likely to continue as the picture develops.
What to watch next is whether UK organisations report incidents of their own, and whether the government's assessment changes as more information emerges from international scanning and exploitation activity.
