PHP2Shell takes government websites offline: how public bodies responded and what the cyber procurement data shows

Quick answer

‍On 21 October 2026, the Office for Budget Responsibility, NHS Scotland and at least seven Scottish councils took websites offline after the NCSC told organisations to patch two critical PHP flaws, known as PHP2Shell, or consider going offline. A day later, the tech minister said 32 government services were unavailable.  Stotles data shows 231 UK public sector cyber notices since late January, 99 from central government.

How did UK government and public bodies respond to the PHP flaw?

The Office for Budget Responsibility took its website offline, the government said work was under way across departments to find and patch exposure, and councils and health boards pulled their sites as a precaution.. The OBR said its decision was "consistent with guidance from the National Cyber Security Centre", a week before it publishes its forecast alongside the Budget. Scotland Secretary Douglas Alexander told Times Radio: "No, I've had no indication whatsoever that there's any problem in terms of a breach of Budget security." A government spokesperson said: "Work is already under way across government to actively identify and patch any potential exposure." (all reported by BBC News)

On 22 October, tech minister Baroness Lloyd of Effra told the House of Lords that 32 government services were unavailable and four were partially unavailable. No 10 said this had largely resulted from precautionary measures taken while security updates were applied (PA Media).

In Scotland, at least seven of the 32 councils and six of the 14 health boards had taken their websites offline by Wednesday evening, along with NHS Scotland. All were back on Thursday morning, though six councils still reported problems with online accounts and payment systems, according to the BBC. The City of Edinburgh Council described its outage as "essential maintenance" and said it was "waiting on an update from our provider", without confirming a link to PHP (The Scotsman). In England, South Ribble Borough Council took its websites offline as a precaution after an alert from the NCSC and had them back online the same day (Lancashire Post).

What did the NCSC tell public bodies to do?

Find every PHP system, patch it, or take it offline until you can.. The NCSC's note, published on 21 October, sets out six steps. These four carry the most weight for public bodies:

• "Identify systems running PHP across your infrastructure, prioritising internet-facing systems. As all versions may be affected, do not limit discovery to outdated PHP versions"
• "If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated"
• "assess the system for any evidence of compromise prior to your upgrade or mitigation and look for backdoors installed by an attacker"
• "Continuously monitor for security updates from third-party software vendors, including for appliances and services that may bundle PHP"

The PHP project is firmer on mitigations: "There are no complete mitigations, updating is the only safe choice." Its fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so bodies on PHP 8.1 or older have to upgrade to a supported version, unless their hosting provider has backported the fix.

What did governments elsewhere do?

Several European governments shut down public web services within hours, and security agencies from the US to Japan issued the same advice.

‍
What is PHP2Shell and what makes it different?

PHP2Shell is the name researchers gave to two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, which allow unauthenticated remote code execution on any server running an affected version of PHP. Researchers at Calif and Wiz found the flaws independently using frontier AI models. Calif worked through OpenAI's Patch the Planet programme (OpenAI), and Wiz found its first flaw on 19 August and reported to PHP on 24 August, calling the findings "among the most severe vulnerabilities discovered in PHP" (Wiz). The BBC reported that the fix was brought forward after details leaked online, and attackers moved quickly. Cloudflare had protective rules live from 03:02 UTC on 21 October and said it had seen attack traffic targeting its customers. BBC News reported no suggestion yet that any major organisation had been breached.

Don Smith of Sophos told the BBC the harder job is finding every place PHP runs, because it "can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it".

Where does the PHP flaw meet council procurement?

In website hosting and support contracts, because Drupal and WordPress both run on PHP and councils buy them as managed services. Wiz showed the flaws could be used to run code without logging in on WordPress, Drupal and Joomla sites (Wiz). At least 10 English councils have published Drupal hosting, support or build contracts since September 2025, most of them on LocalGov Drupal, the shared council website platform. None of these notices say whether a council was affected this week. They do show who holds the patching relationship for each site, which is a head start on finding every place PHP runs.

‍

Other public bodies buy their websites the same way. The Welsh Government awarded Code Enigma a £651k GOV.WALES Drupal hosting and support contract in July 2026, and North East Lincolnshire Council runs a £100k WordPress cloud hosting contract with Nublue to September 2028.

What were public bodies already buying for a day like this?

Departments spent much of 2026 buying cyber assurance and incident response support, the cover the NCSC's guidance now relies on. At least 10 central government bodies bought GovAssure or Cyber Assessment Framework assurance this year, including DSIT for GOV.UK One Login (NCC Group), Homes England (NCC Group, £200k), UK Export Finance (Bridewell), HM Land Registry (LogiQ), Ofsted (Amethyst) and DESNZ (LogiQ). DEFRA has a cyber incident response partner contract with KPMG, the Home Office bought an executive cyber crisis tabletop exercise from KPMG, and the Department for Transport bought cyber exercising from Bridewell.

NHS Scotland's response runs through the Cyber Centre of Excellence at NHS National Services Scotland. It holds a National Cyber Incident Response Retainer with UBDS (£141k, awarded November 2025), which the notice says is "designed to help contain cyber threats and protect critical national systems during a cyber incident". It also bought Cycognito attack surface monitoring through Computacentre, a tool that "highlights vulnerabilities that could be exploited by cyber attackers", which is the discovery job the NCSC's first step describes.

How much cyber security work is the UK public sector buying?

Stotles tracked 231 cyber security notices from UK public bodies between 23 January and 22 October 2026, and central government published the most, with 99.  Councils came second with 42, and 19 of those were for managed security operations centres (SOCs), detection and response or security monitoring.

Stotles platform data · UK notices matching cyber security keywords, checked for relevance by title and deduplicated · 23 Jan to 22 Oct 2026

Notices using the phrase "cyber security" have fallen each year, from 356 in January to September 2023 to 256 over the same months in 2026. That figure counts published notices only, and 30% of this year's relevant notices were call-offs from frameworks such as the Cyber Security Services 3 dynamic purchasing system (DPS) and G-Cloud, which don't always appear as open tenders.

The biggest awards published this year show where the money is going:

Values are as published on each notice. The table leaves out the Home Office's £58.5m MBTP Cyber Security Services award to Accenture, published in September 2026, because the notice gives an August 2024 award date.

Which councils are buying security operations and detection services?

Seventeen councils and combined authorities have published managed SOC, detection and response or threat monitoring awards this year, and 12 of them sit between £100k and £500k. Specialist security firms won seven of those awards, and large resellers such as Softcat, Phoenix Software, Bytes, Boxxe and Insight won six.

‍
Bristol City Council is running a soft market test for a managed extended detection and response (XDR) service, including SOC capability across its infrastructure, cloud, networks and devices, which closes on 28 October 2026. Greater Manchester Combined Authority's managed detection and response contract with SEP2 ends on 23 November 2026, so its renewal decision is close.

Central government is also funding council cyber improvement directly

MHCLG awarded Bridewell a £30m Local Government Cyber Security contract on 1 October 2026 to support continuous improvement of cyber security practice in councils. It runs to 30 September 2028 with three optional one-year extensions, was called off the Cyber Security Services 3 DPS, and is tied to the Government Cyber Security Strategy (2022 to 2030) and the Government Cyber Action Plan. MHCLG also bought an enhanced cyber security operations centre from NCC Group (£2.5m) and CAF assurance from LogiQ (£4.5m) this year.

What do council documents say about cyber risk?

Councils already rate cyber attack among their highest risks, and several name legacy systems and known vulnerabilities as the way in. The London Borough of Merton's corporate risk register raised its cyber attack score from 16 to 20 in December 2025, and lists "exploiting poorly managed legacy systems or services relating to previously reported vulnerabilities" among the main attack routes. South Cambridgeshire District Council's 2025-26 annual governance statement says its exposure "is heightened by the complexity of our IT environment, which includes legacy systems, multiple third-party integrations". Hertsmere Borough Council's draft annual governance statement notes that its cyber insurance renewal requires it to review its cyber arrangements.

Who is winning UK public sector cyber security work?

Large systems integrators take the biggest contracts, and specialist security firms win the largest share of council SOC and detection work. Accenture holds the £25.9m HMCTS managed service, and the Home Office published its £58.5m MBTP Cyber Security Services award to Accenture in September 2026 (the notice gives an August 2024 award date). Bridewell won work across central and local government this year, from MHCLG's £30m council programme to a £3.2m Ministry of Justice assurance contract, a £2.8m NHS Blood and Transplant implementation partner role and South Ribble's detection and response service. Across seven specialist firms we tracked (NCC Group, Bridewell, SEP2, Quorum Cyber, Socura, e2e-assure and Cyberlab), NCC Group and Bridewell take most of the invoiced spend.

‍
Stotles spend data · invoiced payments published by UK public buyers to seven specialist cyber firms · Oct 2025 to Sep 2026

Bridewell's invoiced spend has grown each year, from £1.26m in 2024 to £2.51m in 2025 and £3.01m from January to September 2026. In the last 12 months, 133 public bodies paid at least one of these seven firms, led by the UK Health Security Agency (£3.7m), the Home Office (£1.2m), the Government Property Agency (£0.95m) and the Royal Borough of Kensington and Chelsea (£0.81m). Spend data comes from buyers that publish transparency data, and recent months fill in as they report, so treat the latest figures as a floor.

Most cyber framework buying runs through two routes. G-Cloud 14 carried 25 of this year's 69 cyber call-offs and the Cyber Security Services 3 DPS carried 26, from GovAssure reviews at HM Land Registry and Ofsted to the London Borough of Barnet's £275k call-off this month. G-Cloud 15 opened to buyers on 17 September 2026, and G-Cloud 14 closes to new call-offs on 28 October 2026.

Which cyber contracts come up for renewal in the next 12 months?

Several large central government security contracts end between now and summer 2027, alongside two council detection contracts.

What can suppliers do?

Use the procurement record to find who owns each public body's exposure, and when that contract ends.

1. Help buyers work through the NCSC's steps. The NCSC wants every organisation to find all its PHP systems and look for backdoors, and it points those who can't do this themselves to NCSC-assured Cyber Incident Response providers. Departments with GovAssure, incident response or attack surface contracts already have a route to buy that work.
2. See who looks after each public body's website. Hosting and support notices name the supplier and the end date, so you can see which buyers rely on one partner for PHP-based sites and when that relationship comes up for review.
3. Track SOC and detection renewals. Council contracts in this area run one to five years, and Greater Manchester Combined Authority (November 2026) and West Midlands Combined Authority (January 2027) end soonest. Bristol City Council's soft market test closes on 28 October 2026.
4. Get onto the routes buyers use. G-Cloud and the Cyber Security Services 3 DPS carried 51 of this year's 69 cyber call-offs, so a supplier on neither misses out on most of this framework work. G-Cloud 14 closes to new call-offs on 28 October, so G-Cloud 15 is the route from here, and it reopens to new suppliers 18 months after go-live.
5. Decide how you reach councils. Resellers such as Softcat, Phoenix Software and Bytes won six of 17 council SOC and detection awards this year, so a reseller partnership can be as useful as a direct bid.
6. Read the risk register before the meeting. Councils publish cyber risk scores and controls in budget books and annual governance statements, and Merton's names legacy systems and known vulnerabilities as main attack routes. Use the buyer's own language when you pitch.
   

Stotles tracks these notices, contract expiries and buyer documents in one place, so you can build a cyber security pipeline from the same data used in this article.

Frequently asked questions

Were government or council websites hacked because of the PHP flaw?

There's no evidence of that so far. Cloudflare and Amazon have logged millions of attempts to exploit the flaws, but BBC News reported no suggestion yet that any major organisation had been breached, and Scottish councils took their sites offline as a precaution. The NCSC advises patching, taking systems offline where that isn't possible, and watching for updates from vendors whose products bundle PHP.

Do Drupal and WordPress websites use PHP?

Yes. Drupal and WordPress are both written in PHP, and many UK council websites run on LocalGov Drupal, a shared Drupal platform for councils. Stotles data shows at least 10 English councils publishing Drupal hosting, support or build contracts since September 2025.

Which PHP versions are affected by PHP2Shell?

Wiz, one of the research teams that found the flaws, says every PHP version released in the last decade is affected, going back to PHP 5.4. PHP has released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, so organisations on PHP 8.1 or older should upgrade or check whether their hosting provider has backported the fix. Councils with older, unsupported website platforms face the longest route to a fix.

How do UK councils buy cyber security services?

Councils use a mix of open tenders and framework call-offs. Across the UK public sector this year, G-Cloud 14 and the Cyber Security Services 3 DPS carried 51 of 69 cyber call-offs. Council SOC and detection awards published in 2026 ranged from £43k to £951k, and most sat between £100k and £500k.

What is the Cyber Security Services 3 DPS?

It's a dynamic purchasing system, run by the Government Commercial Agency (GCA), which replaced the Crown Commercial Service in April 2026.. Buyers use it for NCSC-assured services such as GovAssure reviews, penetration testing and managed SOC work. MHCLG used it for its £30m Local Government Cyber Security contract in October 2026.

Which companies supply cyber security to UK councils?

Council SOC and detection awards published this year went to specialists including Socura, Bridewell, e2e-assure, Quorum Cyber, Cyberlab and SEP2, and to resellers including Softcat, Phoenix Software, Bytes, Boxxe and Insight. Bridewell also holds MHCLG's £30m programme to improve cyber security practice across local government.