Council Websites Go Offline Due to PHP Security Flaw
The precautionary measure follows a critical vulnerability in the PHP language that forces an urgent global security update.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you trust your local government to effectively manage service continuity during unexpected digital security issues?
Oxfordshire County Council and Oxford City Council have taken their primary websites offline following a critical security vulnerability discovered in the PHP programming language. The National Cyber Security Centre has identified the issue as a significant risk that could allow attackers to corrupt or exploit affected web systems.
Why it matters
This precautionary shutdown reflects the systemic nature of vulnerabilities within PHP, a server-side scripting language that powers a vast portion of the global web. The move underscores how localized government infrastructure remains sensitive to upstream software bugs in widely used development frameworks.
The vulnerability involves a critical flaw in the PHP programming language that facilitates remote code execution or site corruption. The National Cyber Security Centre recommends that administrators immediately apply the available patch by updating their systems to the latest PHP version.
The players
National Cyber Security Centre
The UK's technical authority on cyber threats that provides guidance on security incidents and software vulnerabilities.
Oxfordshire County Council
A local government body responsible for public services in Oxfordshire that has deployed a temporary portal for urgent matters.
Oxford City Council
The local administrative authority for Oxford that suspended its website as a security precaution.
The details
The vulnerability allows attackers to bypass security protocols by exploiting how PHP processes specific request parameters. By manipulating these inputs, an actor can potentially execute unauthorized code, leading to site corruption. The councils opted to pull their systems offline as a defensive measure to prevent any such exploitation while administrators verify the security of their server environments.
Timeline
October 21, 2026: Oxfordshire and Oxford City councils took their websites offline.
The Tech Race
This incident follows the well-documented pattern of high-risk vulnerabilities in foundational web components like the 2021 Log4j event. It highlights the systemic risks inherent in the widespread reliance on core open-source frameworks for critical public digital infrastructure.
Residents in Oxfordshire needing to contact local authorities should use the temporary service portal or call 01865 519800 for County services and 01865 249 811 for City services. These outages are strictly precautionary, and officials have not reported any actual unauthorized access to council systems.
The takeaway
Organizations relying on PHP must prioritize immediate updates to the latest patched versions to mitigate potential exploitation risks. Users should monitor official government communication channels for updates on when full online functionality will be restored.
Further reading
For more on the latest software security developments, see our Cybersecurity section.
More information
Access the Oxfordshire temporary services website to reach essential government services.
Source note: This article includes information reported by Witney Gazette.
Live Poll
Do you trust your local government to effectively manage service continuity during unexpected digital security issues?
