A security researcher discovered more than 100 serious vulnerabilities across UK government code repositories in 2026, exposing sensitive data across multiple public sector departments due to poor cyber hygiene.
Chris Nesbitt-Smith of ControlPlane scanned 349 public sector codebases across 33 organizations and found vulnerabilities in roughly two-thirds of them. He identified the flaws using Claude’s Opus and Sonnet AI models running on a consumer laptop — tools he says are far from sophisticated. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” he told WIRED. “It’s all daft stuff.”
The most serious case involved the Planning Inspectorate, the English agency handling land-use matters. The agency had accidentally committed login credentials to a public GitHub repository and failed to fully remove them. Those credentials provided complete Microsoft Entra ID access — described by Nesbitt-Smith as “god-tier” read and write permissions — covering all SharePoint sites, private employee OneDrive accounts, HR records, and sensitive legal evidence libraries. “The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” he said. The Planning Inspectorate said its monitoring tools detected the activity in August, fixed the vulnerability within 20 minutes of Nesbitt-Smith’s report, and confirmed no data breach occurred.
Additional vulnerabilities were found in Department of Education systems — including a school procurement service, a teacher application service holding personal details and identity documents, and a training provider register — as well as a Scottish Government open data portal that would have allowed any visitor to read administrative account information and alter site configurations. The affected organizations have since addressed the issues.
The UK government has published its code openly for around a decade on transparency and cost-efficiency grounds, but funding pressures have left departments neglecting maintenance. Some have argued departments should stop publishing source code now that AI has accelerated vulnerability discovery — the NHS reportedly directed technology teams away from open source in May 2026. Nesbitt-Smith cautioned against that approach without first fixing underlying problems, warning it could prevent legitimate researchers from finding flaws while adversaries may already have copied the repositories.
Source: WIRED