Several of Scotland’s public bodies, including councils and NHS boards, temporarily took their websites offline after security flaws were identified in PHP, the programming language that underpins much of the internet. Security updates were released on Wednesday and governments and public bodies worldwide urged website operators to apply the fixes.
PHP vulnerability discovery
Cyber-security researchers at the firms Calif and Wiz discovered the vulnerabilities. Calif, together with the PHP Foundation, took part in an initiative started by OpenAI called Patch the Planet, in which researchers were given access to advanced AI tools to help identify and analyse vulnerabilities in PHP. OpenAI said in a blog post the discovery was “one of the most impactful security issues in recent memory” and added that an internal researcher at the company had also discovered the issue at around the same time as the other firms.
The flaws had gone undetected for more than a decade. Researchers say that by August, after a few weeks of using advanced AI tools, they were discovered. Wiz estimated “roughly 70%” of websites are affected; that figure could not be independently verified.
The PHP Foundation had planned to announce the vulnerability later this month alongside a software patch, but details of the flaw were leaked on social media on Tuesday, prompting the foundation to disclose the flaw and issue a fix earlier than planned.
Local disruption in Scotland
At one point on Wednesday evening, at least seven of Scotland’s 32 councils and six of its 14 health boards had taken their websites offline as a precaution. Several councils, NHS boards and other organisations, including the Care Inspectorate, temporarily suspended access to their sites. Six health board websites were down late on Wednesday but have since been brought back online.
Sanne Dijkstra-Downie, an Edinburgh councillor and MSP for Edinburgh Northern, said: “Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline. It must also ensure that people who need urgent help can still access support while online services are unavailable.”
The problem also affected public bodies and businesses elsewhere, including the Finnish government and the BBC. National cyber agencies, including the UK’s National Cyber Security Centre, the EU and Australian counterparts, urged organisations using PHP to apply the patches. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said in a note.
Security updates released on Wednesday remain the primary mitigation and organisations have been advised to prioritise applying them to affected systems.
