“32 UK government services were taken offline due to the PHP security flaw.” — Wes Streeting. Our verdict: Partly True.
Wes Streeting made the claim on 22 October 2026, in comments reported by the BBC about preparing for supply chain disruption from cyber or climate emergencies.
Our verdict
Partly True
Wes Streeting did say that 32 UK government services were taken offline because of a PHP security flaw, and it is true that some government services went offline for that reason. But we could not find any independent record that confirms the exact number of 32.
What we found
We reached a partly true verdict. A BBC report confirms that Wes Streeting made the claim, and a report in the Bucks Free Press shows he discussed the PHP flaw in the context of government preparedness. The underlying story checks out in part: Orkney Council said its MyOrkney platform was taken offline on 22 October 2026 because of a PHP security vulnerability, and The National Archives said it took services offline on or before 22 October 2026 after guidance from the National Cyber Security Centre. The National Cyber Security Centre also issued guidance about a critical PHP security issue, which fits the timing. What we could not confirm is the figure of 32. No official count of affected services was published, and the two confirmed cases do not add up to a total.
The evidence
3 of 5 sources support the claim; none contradict it.
- Background
A BBC report confirms that Wes Streeting said 32 UK government services were taken offline due to a PHP security flaw. [1]
- Background
The Bucks Free Press confirms that Wes Streeting publicly discussed the PHP security flaw in the context of government preparedness. [2]
- Supports the claim
Orkney Council said its MyOrkney platform was taken offline on 22 October 2026 because of a PHP security vulnerability. [3]
- Supports the claim
The National Archives said it took specific services offline on or before 22 October 2026 after guidance from the National Cyber Security Centre about PHP vulnerabilities. [4]
- Supports the claim
The National Cyber Security Centre issued guidance about a critical PHP security issue, which matches the timing of the October 2026 outages. [5]
What we could not confirm
- Whether exactly 32 UK government services were taken offline. No official count has been published, and we found no list of all affected services.
How we checked
We looked at the original BBC report of the claim, another news report of the same comments, and official statements from Orkney Council, The National Archives and the National Cyber Security Centre. We also looked for any official government count of affected services, but found none. We reviewed 5 relevant sources.
Sources
- [1]www.bbc.co.uk · Streeting: Prepare for supply chain disruption from cyber or climate emergencies
- [2]bucksfreepress.co.uk · Streeting urges public be ‘alert not alarmed’ amid call to stock up for a crisis
- [3]orkney.gov.uk · Temporary unavailability of the MyOrkney platform · October 22, 2026
- [4]nationalarchives.gov.uk · Issues with The National Archives website · October 21, 2026
- [5]ncsc.gov.uk · Critical security issue affecting PHP
- [6]Photo: Chris McAndrew / Wikimedia Commons, CC BY 3.0
Have evidence we missed?
If you know of a source that confirms or contradicts this claim, send us the link. We review every submission and update fact checks when new evidence changes the picture.
Measured Take updates fact checks when new evidence emerges. Corrections are noted on the page.
All fact checks