Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R04 Services lost to precautionary shutdowns / R04-2

R04-2: Councils and police offline without saying why

Because UK councils and the Met Police went offline calling it maintenance or a precaution and did not confirm the link, residents could not tell an outage from an attack, resulting in lost trust and calls the council could not answer.

Rating 15 high · Likelihood 5 Happening · Impact 3 Significant · Kind Reputational · Acceptance not recorded

Basis. Reported by the press; Oxford's statement quoted.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

Stakeholder	Part	Why	Its register
Local councils	owner	Took the sites down and chose the words.	1 risk
Communications team	treater	Says what is known.	2 risks
UK NCSC	informer	Its advice was the reason.	1 risk

What it arises from

PHP versions the project no longer fixes. 8.1 and older get no upstream fix; reaching them needs a distribution backport, paid support or an upgrade.

The evidence

Claim	Status	Fact-check	Sources
Edinburgh council's site went offline late on 21 October; the council called it 'essential maintenance' and did not confirm a link	reported	A3 Echoed	The Scotsman
Oxford City Council: 'a precaution because of a worldwide issue with the underlying technology and is not a cyber incident'	reported	A2 Reported	Oxford Chronicle
Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility were unavailable; Bristol, Lambeth and Barnet council sites showed errors	reported	A3 Echoed	LBC Insurance Business

Treatments

Treatment	Status	Where
A holding statement prepared before the outage	missing	Briefing for a media and communications team: What can we say that is true, what should we not say, and what will we be asked?

The standards that govern it

Framework	Control	What it asks	Family
Cyber Essentials	SUM	Security update management: high and critical updates within 14 days of release; unsupported software removed	Frameworks and control catalogues
NIST CSF 2.0	RS.CO-03	Information is shared with designated internal and external stakeholders	Frameworks and control catalogues
ISO/IEC 27001	A.5.24	Incident management planning and preparation	Management-system standards

The stories that tell it

php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof (through Services lost to precautionary shutdowns)
Where php2shell stands: many sites dark, millions of attempts, no confirmed breach (through Services lost to precautionary shutdowns)

On this site: Impact: taken offline versus compromised · Briefing for a media and communications team: What can we say that is true, what should we not say, and what will we be asked?