PHP2Shell 安全事故已迫使英国政府 32 项服务下线，另有 4 项服务部分不可用，白厅正争分夺秒修补在互联网上造成严重破坏的关键漏洞。这些数字于周四在上议院披露，科技大臣埃夫拉的劳埃德女男爵（Baroness Lloyd of Effra）在发现 PHP 存在两个关键缺陷后，向贵族议员们通报了中断情况。“我目前掌握的信息是，有 32 项政府服务不可用，4 项部分不可用，”劳埃德对贵族议员们说。
The PHP2Shell security fiasco has forced 32 UK government services offline and left another four partially unavailable as Whitehall scrambles to patch the critical vulnerabilities wreaking havoc across the web. The figures were disclosed in the House of Lords on Thursday, where tech minister Baroness Lloyd of Effra outlined the disruption following the discovery of two critical flaws in PHP. "Currently, the information I have is that 32 government services are unavailable and four are partially unavailable," Lloyd told peers.
“这主要是由于在应用安全更新和缓解措施期间，为保护系统而采取的预防性措施所致。”她补充道：“我们正非常谨慎地与各部门合作，在完成补救活动后安全、稳妥地恢复这些服务。”白厅尚未公布受影响服务的完整清单，但预算责任办公室（OBR）是已知下线网站的机构之一，恰逢下周的预算案即将出台，显得格外不合时宜。
"That has resulted largely from precautionary measures taken to protect systems while security updates and mitigations are applied." "We are working very carefully with departments to restore the services safely and securely following that remediation activity," she added. Whitehall has not published a full list of affected services, although the Office for Budget Responsibility (OBR) is among those known to have taken their websites offline, rather inconveniently with next week's Budget looming.
贵族议员们还提出了关于驾驶员和车辆许可局（DVLA）及警方服务受干扰的报告。英国并非唯一“拔掉插头”的国家。德国、法国、比利时、芬兰和荷兰的政府网站也已作为预防措施下线，澳大利亚自身的网络安全机构网站亦在其中。大西洋彼岸，美国国家安全局（NSA）已敦促组织修补漏洞或断开易受攻击系统的连接，尽管美国政府尚未公开确认有任何网站关闭。
Peers also raised reports of disruption affecting the DVLA and police services. Britain isn't alone in pulling the plug. Government websites in Germany, France, Belgium, Finland, and the Netherlands have also been taken offline as a precaution, along with Australia's own cybersecurity agency website. Across the Atlantic, the NSA has urged organizations to patch or disconnect vulnerable systems, although the US government has not publicly confirmed any website shutdowns.
PHP2Shell 包含两个关键漏洞 CVE-2026-109618 和 CVE-2026-109619，可能允许未经身份验证的攻击者在易受攻击的服务器上执行代码。国家网络安全中心（NCSC）警告组织立即修补漏洞，或考虑将受影响系统下线，直到修复完成。
PHP2Shell comprises two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated attackers to execute code on vulnerable servers. The National Cyber Security Centre (NCSC) warned organizations to patch immediately or consider pulling affected systems offline until they could be fixed.
英国国家网络安全中心（NCSC）上周接受了OpenAI关于这一潜在特定漏洞的简报，并一直在努力确保披露工作以协调方式与供应商同步进行，以便有充足的准备来保护客户，Lloyd表示。安全公司Calif利用OpenAI的GPT-5.6 Sol模型发现了其中一个PHP漏洞，而Google的Wiz则在AI工具的帮助下分别发现了这两个缺陷。随后，OpenAI深入研究了这些漏洞，并与供应商和政府机构合作发布消息。Lloyd表示，政府在公开披露前建立了跨部门事件响应行动。NCSC还向企业和其他组织发送了5万份预警。
"The NCSC was briefed by OpenAI last week on this potential specific vulnerability and has been working to ensure that disclosure happened in a co-ordinated way with vendors, so there was sufficient preparation to protect customers," Lloyd said. Security firm Calif found one of the PHP bugs using OpenAI's GPT-5.6 Sol model, while Google's Wiz separately uncovered both flaws with the help of AI tools. OpenAI then dug into the vulnerabilities itself and worked with vendors and government agencies to get the word out. The government established a cross-departmental incident response operation before public disclosure, Lloyd said. The NCSC also sent 50,000 warnings to businesses and other organizations.
此次中断已蔓延至中央政府之外。自由民主党贵族院议员Baroness Ludford指出，据报道有多个地方议会的服务被迫下线，包括爱丁堡、牛津、布里斯托、兰贝斯和巴内特。她质疑为何中央政府和地方政府仍置身于政府《网络安全与韧性法案》拟设的法定职责之外，该法案将于周一重返贵族院审议。
The disruption has spread beyond central government. Liberal Democrat peer Baroness Ludford pointed to several councils whose services had reportedly been taken offline, including Edinburgh, Oxford, Bristol, Lambeth, and Barnet. She questioned why central government and local authorities remain outside the statutory duties proposed under the government's Cyber Security and Resilience Bill, which returns to the Lords on Monday.
Lloyd告诉贵族院议员：“我们目前尚未发现任何确凿证据表明，中央政府系统因这些漏洞而遭到入侵”，随后他将这一评估范围扩大至更广泛的英国公共部门。AWS表示，攻击者在漏洞公开披露前四天就已开始利用这些缺陷，而Cloudflare此后已记录到数百万次将其武器化的尝试。®
"We are not currently aware of any confirmed compromise of central government systems resulting from these vulnerabilities," Lloyd told peers, later extending that assessment to the wider UK public sector. AWS says attackers were exploiting the flaws four days before they were publicly disclosed, while Cloudflare has since recorded millions of attempts to weaponize them. ®