Government services go dark as PHP attacks surge worldwide
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, October 23rd, 2026.
Government services were disrupted as agencies took vulnerable PHP systems offline. In the UK, ministers reported 32 services unavailable and four partly disrupted. Most of that disruption came from precautionary action while teams applied patches and mitigations, and officials had not confirmed a compromise of central government systems. Other governments also disconnected sites as observers reported broad exploitation attempts after fixes appeared.
The challenge is the size and condition of the PHP footprint. Many internet-facing installations are old, unevenly maintained, or already beyond support, which means they won’t receive fixes. Even crude or unsuccessful attempts can crash systems, and more reliable attacks may still emerge.
For leaders, temporary downtime may be the safer choice when an exposed service can’t be secured. For defenders, the priority is to find every PHP instance, update supported versions, and investigate for signs of compromise. Inventory speed matters just as much as patch speed here.
The practical move is clear. Inventory all PHP systems immediately, patch supported releases, and disconnect exposed systems that can’t be secured.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
