What changed
A security researcher, Chris Nesbitt-Smith from ControlPlane, discovered more than 100 serious vulnerabilities in publicly available UK government code. These vulnerabilities, stemming from poor cyber hygiene, put sensitive data at risk. The issues were found across multiple departments, including the Department of Health and Social Care, the Home Office, and local authorities.
What this means in practice
The vulnerabilities were identified using consumer-grade AI models on a laptop, suggesting that many could have been caught by routine IT health checks. In the most severe case, the Planning Inspectorate accidentally committed login credentials to a public GitHub repository. These credentials provided extensive access to sensitive data, including HR records and legal evidence. A spokesperson for the Planning Inspectorate confirmed that their cyber monitoring tools detected the activity and that the vulnerability was resolved within 20 minutes, with no data breach occurring.
Limitations and availability
The issues highlighted are not related to open source practices but rather to internal processes when using public tools. Amanda Brock of OpenUK noted that the data exposure was due to a failure in following good process, not an open source security issue. The affected organizations have since addressed the vulnerabilities. However, the researcher warns that closing off code repositories without fixing underlying issues could draw more attention to the vulnerabilities, as adversaries may have already mirrored these repositories.
