Technology · News
Google Cloud Outage Disrupts UK Banks and NHS; Google Cites Power Failure, Not a Software Bug
Published:
In brief
A Google Cloud outage on 20 October 2026 knocked out services for UK banks including Lloyds, HSBC and Revolut, plus NHS England, Royal Mail and other sites, after a power failure hit a London-region data-center zone. Google said the roughly eight-hour disruption was caused by this power event, not a software vulnerability; a separate critical PHP security flaw disclosed the same week is unrelated to this incident, according to the sources reviewed.
What happened
On 20 October 2026, Google Cloud's europe-west2 region, which hosts the company's London data centers, went down starting at 06:08 UTC, according to a review of Google's status page by The Register. Google attributed the failure to a power event inside the europe-west2-b availability zone, one of three zones that make up the London region.
A power event caused an outage within europe-west2-b zone. The power event is mitigated. We are seeing the recovery of services and are prioritizing the recovery of existing workloads.
Google said the power event was mitigated by 14:03 UTC, roughly eight hours after the outage began, The Register reported, after which recovery continued for most affected customers.
| Time | Event |
|---|---|
| 06:08 | Outage begins in europe-west2-b zone, London region |
| 11:58 | Google posts update saying full recovery should be completed 'tentatively' by 13:00 UTC |
| 14:03 | Google says the power event is mitigated; services recovering |
Who was affected
The Register reported that roughly 38 Google Cloud products were disrupted, including Cloud Run, Google App Engine, Google Kubernetes Engine, Cloud Filestore, the BigQuery Data Transfer Service, Managed Service for Apache Kafka and Google Cloud NetApp Volumes.
- Lloyds Bank and HSBC — online banking disruptions (The Register)
- Revolut — card payments, ATM withdrawals, money transfers, currency exchange and share trading affected (Global Banking and Finance)
- Royal Mail, DPD, Rightmove, BT and Screwfix — service disruptions reported (The Register)
- NHS England — services affected (Global Banking and Finance)
Revolut said that customers' money and data remained safe despite the disruption to its services, according to Global Banking and Finance.
Regulatory response
The UK Financial Conduct Authority said it was aware of the incident and was engaging with Google and affected firms to understand the impact, Global Banking and Finance reported.
Since July 2026, UK regulators have designated Google Cloud a "Critical Third Party" alongside Amazon Web Services, Microsoft and Oracle, a status that reflects regulatory concern about financial-sector concentration risk when many firms depend on the same small group of cloud providers, according to Global Banking and Finance.
A separate PHP security flaw surfaced the same week
In the same period, researchers disclosed two critical remote-code-execution vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell," affecting PHP versions 5.4 and later, according to security firm Sansec. The PHP security team rated both flaws 9.2 on the CVSS v4.0 scale, and details leaked on 20 October ahead of a coordinated disclosure, with an emergency patch release scheduled for 21 October at 14:00 UTC.
Cloudflare reported early exploitation attempts against the PHP flaws from 07:43 UTC on 21 October, Sansec said. None of the sources reviewed for this article linked the PHP vulnerabilities to the Google Cloud outage; Google's own account attributed that incident to a power event in its London data center, not to a software flaw.
What is not yet known
Google's status page, as reported by The Register, did not give a detailed technical explanation of what caused the power event itself, such as whether it originated in grid supply or in on-site backup equipment. Google had not published a full post-incident report at the time these sources were reviewed.
Questions
- What caused the Google Cloud outage on 20 October 2026?
- Google said a power event inside the europe-west2-b zone of its London region caused the outage; the company did not attribute it to a software vulnerability, according to The Register.
- Was the outage related to the critical PHP vulnerability reported the same week?
- No source reviewed links the two events. Google attributed the outage to a power event, while the PHP flaws (CVE-2026-109618 and CVE-2026-109619) were a separate disclosure affecting PHP-based software broadly, per Sansec.
- Which companies and services were affected by the outage?
- Reported disruptions hit Lloyds Bank, HSBC, Revolut, Royal Mail, Rightmove, DPD, BT, Screwfix and NHS England, according to The Register and Global Banking and Finance.
- How long did the Google Cloud outage last?
- Google said the outage began at 06:08 UTC and the power event was mitigated by 14:03 UTC the same day, roughly eight hours later, per The Register.
- Is Revolut customer money safe after the outage?
- Revolut said customers' money and data remained safe despite the service disruption, according to Global Banking and Finance.
Sources
This piece was prepared with artificial intelligence and passed an automated source check before publication. If you see an error, ask for a correction. Request a correction or reply · How we make this
Related
TechnologyComparison
PlayStation 5 Pro vs a Matching Gaming PC: Price and Performance Compared
Sony launched the PlayStation 5 Pro at $699.99 in November 2024, but according to Engadget's reporting its US price had climbed to roughly $900 by April 2026, and one October 2026 SlashGear estimate puts it near $1,580. A PC built around the GPU and CPU that benchmarkers consider closest to the console costs roughly $1,050 to $1,530 depending on the parts chosen, according to SlashGear and BGR testing.
TechnologyNews
Two Critical PHP Flaws Dubbed "PHP2Shell" Expose Most of the Web
Two critical PHP vulnerabilities nicknamed "PHP2Shell" let attackers run malicious code on web servers without logging in, according to the security firm that found them. Patches for CVE-2026-109618 and CVE-2026-109619 shipped on October 21, 2026, months after researchers first reported the bugs, and multiple firms have since logged exploitation attempts in the wild.
TechnologyList
Best Android Apps and Utilities You Can Get Outside Google Play Store
Android users are not limited to Google Play: the open-source repository F-Droid, the anonymous Google Play client Aurora Store, the update tracker Obtainium, and the Shizuku-based catalog ShizuStore all distribute apps that the official store does not list or allow. Here are nine stores and utilities worth knowing, based on their own listings and reporting from MakeUseOf and Pocket-lint.
TechnologyArticle
PHP2Shell: the two critical PHP flaws that pushed governments offline
PHP2Shell is the nickname for two critical, unauthenticated remote-code-execution flaws in the PHP programming language — CVE-2026-109618 and CVE-2026-109619 — disclosed on 20–21 October 2026. Because PHP powers a very large share of the world's websites, the flaws led several governments to take public sites offline as a precaution. The official fix is upgrading PHP; interim server-side mitigations exist, but there is little an individual reader can do beyond watching for breach notices and using strong, unique passwords.