Scottish councils and NHS boards pull websites offline after global security flaw
Flaws in the PHP programming language, which runs much of the web, led at least seven councils and six health boards to take sites down as a precaution.
Computer servers in a data centre. File photo. · Photograph: Christopher Bowns (CC BY-SA 2.0)
Councils, health boards and other public bodies across Scotland have taken their websites offline after serious security flaws were found in PHP, a programming language that underpins much of the internet.
At one point on Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards had suspended their sites as a precaution. Several came back online later that night.
Still offline at 10pm were City of Edinburgh Council, Highland Council, Orkney Islands Council, the Care Inspectorate and Gaelic body Bòrd na Gàidhlig.
The flaws were found by researchers at the firms Calif and Wiz, using AI tools as part of an OpenAI-backed initiative. They had gone undetected for more than a decade. Details leaked online on Tuesday, prompting the PHP Foundation to release a fix earlier than planned.
The UK's National Cyber Security Centre has urged organisations to apply the updates and said systems should be taken offline if they cannot be fixed immediately.
Edinburgh MSP Sanne Dijkstra-Downie said councils must tell residents clearly how long services will be down and make sure people who need urgent help can still get it.