Cybercriminals Abandon Raid After Three Hours Hunting for Planning Form
LOCAL GOVERNMENT, EVERYWHERE: Britain’s councils have received an alarming cybersecurity warning after researchers found PHP code associated with critical vulnerabilities visible on more than 40 per cent of council websites surveyed.
Experts fear attackers could exploit weaknesses in poorly patched systems.
PHP Vulnerability Found on More Than 40 Per Cent of UK Council Websites
The survey, reported by LocalGov, came after the flaws prompted organisations across the world to take sites offline, including several UK councils. A minister told the House of Lords that thirty-two government services were offline while security work was carried out, LBC reported.
Residents, meanwhile, are asking whether hackers might finally accomplish what twenty years of local government modernisation could not: make the bin collection calendar intelligible.
The National Cyber Security Centre has urged organisations using PHP to install security updates promptly.
PHP is not an obscure department where councillors decide the colour of pavement furniture. It is software behind a huge share of the internet; Cloudflare puts it at almost 70 per cent of websites, and it underpins platforms such as WordPress.
The vulnerabilities are real, although seeing PHP on a website does not prove that site has been breached or left unpatched. That distinction matters, even if a council website’s actual navigation remains a crime against geography.
The Council Website: A Feat of Engineering
A British council website is a remarkable piece of engineering.
It can display seventeen photographs of smiling councillors, explain the authority’s corporate values in nine languages and invite residents to participate in an eight-week consultation about the colour of a proposed bench.
Ask it which Tuesday the recycling comes, however, and it directs you to a PDF from 2019 with the helpful filename FINAL_revised_FINAL3.pdf.
In a Prat field test, a database burglar attempts to penetrate a council website and is immediately asked whether he wishes to access refuse services, neighbourhood services, environmental services or the Customer Experience Transformation Hub. After forty minutes, he abandons the burglary and reports himself for illegal dumping.
The council responds within twenty working days, excluding bank holidays and the days that contain a letter R.
Why Council Cybersecurity Is Genuinely Serious
Cybersecurity is genuinely serious. Vulnerable websites can expose sensitive information or allow outsiders to interfere with essential services.
Councils manage data about residents, businesses and local decisions; they need qualified technical staff, tested updates and sensible contingency plans. The NCSC’s guidance on preparing for a vulnerability patch wave says as much. Residents do not deserve to lose access to services because a supplier has postponed a patch until the next strategy meeting.
The Hamster Wheel of Digital Transformation
The bureaucratic irony is irresistible.
Local authorities regularly instruct citizens to use online portals rather than telephone departments, saving money and supposedly speeding everything up. When the portal itself becomes unavailable, a resident must telephone a department to ask how to access the portal. The recorded message directs callers to the website.
This is not digital transformation. This is a hamster wheel with a broadband contract.
The Council Cyber Resilience League awards points for repaired vulnerabilities, clear emergency information and web pages that work on a phone. Bonus points are available when a service can be completed without creating an account named after your mother’s first budgerigar.
No council has yet agreed to enter the competition, possibly because the registration form is inaccessible.
Britain does not need to choose between secure council websites and usable council websites. A competent government can provide both. But until that glorious day, residents might want to print their bin calendars, assuming they can discover them first.
The hackers may already have given up. The only thing more secure than a British council’s database is information hidden behind its customer services menu.
Evidence From the Town Hall
Exhibit A: Cookie Banner, Council Homepage
We use cookies. By continuing you accept cookies, tracking, and the loss of your afternoon. “Reject all” is available on page four of the Customer Experience Transformation Hub, under Refuse Services, beside the bins.
Exhibit B: IT Helpdesk Log, Monday
09:00 — Security patch scheduled.
09:05 — Patch postponed to the strategy meeting.
09:30 — Strategy meeting postponed pending the patch.
10:15 — Working group formed to decide which came first.
11:00 — Working group adjourned for sandwiches.
11:40 — Hackers, according to the firewall, “also on hold”.
Exhibit C: One-Star Review of FINAL_revised_FINAL3.pdf
★☆☆☆☆ “Downloaded the bin calendar. It is for 2019. Put the bins out on the date shown. They are now a feature of the pavement.” — Trevor, Basingstoke
Exhibit D: Invoice for Digital Transformation Consultancy
| Item | Fee |
|---|---|
| Discovery workshop (three days) | £4,500.00 |
| Renaming “Bins” as “Refuse Services” | £2,000.00 |
| Chatbot named “Binny” | £6,000.00 |
| Helping residents to find their bin day | Out of scope |
| Total | £12,500.00 |
Five Observations on Council Websites
- I can order a pizza, track the driver, and see his dog on my phone. I cannot find out when the bin man’s coming. Pizza has a satellite. Bins have a PDF.
- Every council has a “Customer Experience Transformation Hub.” You know what the customer experience is? Looking for the hub.
- If hackers can’t find the planning form, how do the rest of us feel? We’ve been hacked for years, mate. By the website.
- “We take your security seriously.” Right. You’ve got a login that wants my mother’s maiden name, my first pet and a blood sample, and you still sent my bin day to my ex.
- Somewhere there’s a criminal mastermind with a laptop and three monitors, typing “council tax reduction,” and getting the phone number for a department that closed in 2014. That’s not a crime. That’s justice.
Further reading:LocalGov on council websites; NCSC: Critical security issue affecting PHP; NCSC: Preparing for a vulnerability patch wave; LBC on government services taken offline.
Disclaimer: No council websites were hacked in the making of this piece, mostly because we could not find the login page either. Our British Onion approach to the news remains fully patched and occasionally online.
