Technology · News
Google Cloud Outage Disrupts UK Banks and NHS; Google Cites Power Failure, Not a Software Bug
Published:
In brief
A Google Cloud outage on 20 October 2026 knocked out services for UK banks including Lloyds, HSBC and Revolut, plus NHS England, Royal Mail and other sites, after a power failure hit a London-region data-center zone. Google said the roughly eight-hour disruption was caused by this power event, not a software vulnerability; a separate critical PHP security flaw disclosed the same week is unrelated to this incident, according to the sources reviewed.
What happened
On 20 October 2026, Google Cloud's europe-west2 region, which hosts the company's London data centers, went down starting at 06:08 UTC, according to a review of Google's status page by The Register. Google attributed the failure to a power event inside the europe-west2-b availability zone, one of three zones that make up the London region.
A power event caused an outage within europe-west2-b zone. The power event is mitigated. We are seeing the recovery of services and are prioritizing the recovery of existing workloads.
Google said the power event was mitigated by 14:03 UTC, roughly eight hours after the outage began, The Register reported, after which recovery continued for most affected customers.
| Time | Event |
|---|---|
| 06:08 | Outage begins in europe-west2-b zone, London region |
| 11:58 | Google posts update saying full recovery should be completed 'tentatively' by 13:00 UTC |
| 14:03 | Google says the power event is mitigated; services recovering |
Who was affected
The Register reported that roughly 38 Google Cloud products were disrupted, including Cloud Run, Google App Engine, Google Kubernetes Engine, Cloud Filestore, the BigQuery Data Transfer Service, Managed Service for Apache Kafka and Google Cloud NetApp Volumes.
- Lloyds Bank and HSBC — online banking disruptions (The Register)
- Revolut — card payments, ATM withdrawals, money transfers, currency exchange and share trading affected (Global Banking and Finance)
- Royal Mail, DPD, Rightmove, BT and Screwfix — service disruptions reported (The Register)
- NHS England — services affected (Global Banking and Finance)
Revolut said that customers' money and data remained safe despite the disruption to its services, according to Global Banking and Finance.
Regulatory response
The UK Financial Conduct Authority said it was aware of the incident and was engaging with Google and affected firms to understand the impact, Global Banking and Finance reported.
Since July 2026, UK regulators have designated Google Cloud a "Critical Third Party" alongside Amazon Web Services, Microsoft and Oracle, a status that reflects regulatory concern about financial-sector concentration risk when many firms depend on the same small group of cloud providers, according to Global Banking and Finance.
A separate PHP security flaw surfaced the same week
In the same period, researchers disclosed two critical remote-code-execution vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell," affecting PHP versions 5.4 and later, according to security firm Sansec. The PHP security team rated both flaws 9.2 on the CVSS v4.0 scale, and details leaked on 20 October ahead of a coordinated disclosure, with an emergency patch release scheduled for 21 October at 14:00 UTC.
Cloudflare reported early exploitation attempts against the PHP flaws from 07:43 UTC on 21 October, Sansec said. None of the sources reviewed for this article linked the PHP vulnerabilities to the Google Cloud outage; Google's own account attributed that incident to a power event in its London data center, not to a software flaw.
What is not yet known
Google's status page, as reported by The Register, did not give a detailed technical explanation of what caused the power event itself, such as whether it originated in grid supply or in on-site backup equipment. Google had not published a full post-incident report at the time these sources were reviewed.
Questions
- What caused the Google Cloud outage on 20 October 2026?
- Google said a power event inside the europe-west2-b zone of its London region caused the outage; the company did not attribute it to a software vulnerability, according to The Register.
- Was the outage related to the critical PHP vulnerability reported the same week?
- No source reviewed links the two events. Google attributed the outage to a power event, while the PHP flaws (CVE-2026-109618 and CVE-2026-109619) were a separate disclosure affecting PHP-based software broadly, per Sansec.
- Which companies and services were affected by the outage?
- Reported disruptions hit Lloyds Bank, HSBC, Revolut, Royal Mail, Rightmove, DPD, BT, Screwfix and NHS England, according to The Register and Global Banking and Finance.
- How long did the Google Cloud outage last?
- Google said the outage began at 06:08 UTC and the power event was mitigated by 14:03 UTC the same day, roughly eight hours later, per The Register.
- Is Revolut customer money safe after the outage?
- Revolut said customers' money and data remained safe despite the service disruption, according to Global Banking and Finance.
Sources
This piece was prepared with artificial intelligence and passed an automated source check before publication. If you see an error, ask for a correction. Request a correction or reply · How we make this
Related
TechnologyNews
Critical PHP Flaws Force Government Sites Offline Before Emergency Patch
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, led government agencies in the Netherlands and Finland to take websites offline on October 21, 2026, hours before PHP's developers shipped an emergency patch. Both flaws are rated 9.2 on the CVSS v4.0 scale and allow remote code execution without authentication; Cloudflare reported early exploitation attempts before the fix went out.
TechnologyNews
EU Opens Formal Digital Services Act Probe Into Booking.com Over Scams and Fake Listings
The European Commission has opened a formal investigation into Booking.com under the EU's Digital Services Act, examining whether the platform did enough to stop fraudulent listings and phishing scams that exploit guest data. The probe also looks at whether paid "boosted" listings are clearly labeled as advertisements. It is the first formal DSA case brought against Booking.com.
TechnologyNews
Cyberattack Takes Food Lion, Hannaford Sites Offline for More Than a Week
A cybersecurity incident at Ahold Delhaize, parent company of Food Lion, Hannaford, Stop & Shop and Giant Food, knocked websites, apps and online ordering offline across the US starting October 11-12, 2026. Physical stores stayed open throughout, and the company says it has found no evidence customer data was stolen, though some US digital services were still being restored more than a week later.
TechnologyArticle
Meta's AI Spending Surge: How Capex Growth Is Squeezing Profitability
Meta has raised its 2026 artificial-intelligence infrastructure spending guidance three times, from an initial $115–135 billion to as much as $130–145 billion, nearly double the $72.2 billion it spent in 2025. The buildout pushed free cash flow near breakeven in the second quarter and triggered sharp share-price drops, setting up heightened investor scrutiny ahead of Meta's third-quarter 2026 results on October 21.