Science & Tech · Cybersecurity · 1 hr ago
Researcher Finds More Than 100 Vulnerabilities in UK Government Code
A security researcher found more than 100 serious flaws in code published by UK government departments and other public bodies.
The researcher, Chris Nesbitt-Smith of ControlPlane, scanned 349 codebases across 33 organizations using AI models on a laptop.
The most serious flaw was at England’s Planning Inspectorate, where a login credential exposed in a public GitHub repository could have opened access to SharePoint sites, staff OneDrive accounts and sensitive records.
The agency fixed the flaw within 20 minutes of being alerted and said its monitoring had detected the researcher’s activity; it found no data breach.
Other issues affected services at the Department for Education and a Scottish Government data portal, and the organizations have since dealt with them.
UK public bodies have published code funded by public money for about a decade to support transparency and reuse, but limited funding has left some technology poorly maintained.
The findings have renewed debate over whether government code should stay public as AI makes vulnerabilities easier to find; Nesbitt-Smith says hiding code without fixing the underlying problems could make them harder for researchers to spot.
A security researcher found more than 100 serious vulnerabilities in publicly available UK government code.
Chris Nesbitt-Smith of ControlPlane scanned 349 public-sector codebases across 33 organizations and found vulnerabilities in about two-thirds.
The flaws included exposed credentials at the Planning Inspectorate and weaknesses in Department for Education and Scottish Government services.
The affected organizations have dealt with the issues, and the Planning Inspectorate said it found no data breach.
The findings have renewed debate about whether government departments should publish source code openly as AI tools speed up vulnerability discovery.
- Who
- Security researcher Chris Nesbitt-Smith of ControlPlane found the vulnerabilities. Affected organizations included the Planning Inspectorate, the Department for Education and the Scottish Government.
- What
- More than 100 serious vulnerabilities were found in publicly available UK government code.
- When
- The article was published on 10 November 2026. The Planning Inspectorate said its monitoring tools detected Nesbitt-Smith’s activity in August.
- Where
- Across UK government and public-sector codebases, including services in England and a Scottish Government open data portal.
- Why
- The article attributes the vulnerabilities to poor cyber hygiene, neglected technology maintenance and failures to follow good processes.
Arguments for open source publication
Arguments for limiting open source publication
Transparency and reuse
Arguments for open source publication
The UK government has published publicly funded code openly for around a decade to support transparency and cost-efficient reuse.
Arguments for limiting open source publication
Some argue departments should stop publishing source code because AI has accelerated vulnerability discovery.
Security approach
Arguments for open source publication
Nesbitt-Smith said hiding code without fixing underlying problems would prevent researchers from finding vulnerabilities.
Arguments for limiting open source publication
The NHS reportedly told technology teams in May to transition away from open source code amid security concerns about AI models.
Nature of the incident
Arguments for open source publication
OpenUK chief executive Amanda Brock said the Planning Inspectorate issue was an internal process failure, not an open source security issue.
Arguments for limiting open source publication
The article reports that departments have raised concerns about the security impact of AI-assisted vulnerability discovery.
The UK government began openly publishing code produced with public money.
The NHS reportedly ordered technology teams to transition away from open source code amid concerns about AI and security.
The Planning Inspectorate said its cyber monitoring tools detected Nesbitt-Smith’s activity.
The Planning Inspectorate said it identified and fixed the vulnerability.
- Vulnerabilities found
- More than 100
- Codebases scanned
- 349 across 33 organizations
- Affected codebases
- About two-thirds had vulnerabilities
- Planning Inspectorate response
- Fixed the vulnerability within 20 minutes of the report
- Reported data breach
- None, according to the Planning Inspectorate
What people are saying
None of this is the level of sophistication that general media is worried about in terms of cyber attacks.
The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there
That’s not an open source security issue.
We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher’s work and for alerting us to it,