Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R04 Services lost to precautionary shutdowns / R04-2

R04-2: Councils and police offline without saying why

Because UK councils and the Met Police went offline calling it maintenance or a precaution and did not confirm the link, residents could not tell an outage from an attack, resulting in lost trust and calls the council could not answer.

Explore the graph from this risk · What the graph is missing

Rating 15 high · Likelihood 5 Happening · Impact 3 Significant · Kind Reputational · Acceptance not recorded

Basis. Reported by the press; Oxford's statement quoted.

The path

Told inphp2shell in perspectivephp2shell in perspec…Where php2shell standsWhere php2shell stan…Acted on byCommunications teamCommunications teamBoard and executivesBoard and executivesStory site agentStory site agentCarried byLocal councils (owner)Local councils (owne…Communications team (treater)Communications team …UK NCSC (informer)UK NCSC (informer)RiskR04-2 Councils and police offline without saying whyR04-2 Councils and p…Arises fromPHP versions the project no longer fixesPHP versions the pro…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
Local councilsownerTook the sites down and chose the words.1 risk
Communications teamtreaterSays what is known.2 risks
UK NCSCinformerIts advice was the reason.1 risk

What it arises from

The evidence

ClaimStatusFact-checkSources
Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a linkreportedA3 EchoedThe Scotsman
Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'reportedA2 ReportedOxford Chronicle
Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errorsreportedA3 EchoedLBC Insurance Business

Treatments

TreatmentStatusWhere
A holding statement prepared before the outagemissingBriefing for a media and communications team: What can we say that is true, what should we not say, and what will we be asked?

The standards that govern it

FrameworkControlWhat it asksFamily
Cyber EssentialsSUMSecurity update management: high and critical updates within 14 days of release; unsupported software removedFrameworks and control catalogues
NIST CSF 2.0RS.CO-03Information is shared with designated internal and external stakeholdersFrameworks and control catalogues
ISO/IEC 27001A.5.24Incident management planning and preparationManagement-system standards

The stories that tell it

On this site: Impact: taken offline versus compromised · Briefing for a media and communications team: What can we say that is true, what should we not say, and what will we be asked?