Scottish councils and health board websites taken offline after global security threat

Scottish councils and NHS health boards took their websites offline on Wednesday following a global cyber security threat.

The City of Edinburgh Council and the Care Inspectorate were among the organisations to suspend access to their websites after a researcher using AI discovered a “critical security issue” in a programming language.

The identified security issue could allow attackers to remotely control any web server running the widely used programming language, PHP.

Organisations were urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the software.

If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.

On Wednesday, at least seven of the 32 local authorities and six health boards in Scotland had taken their websites offline.

Council websites in Argyll and Bute, East Lothian, the Highlands and Midlothian were among those affected.

The Glasgow Golden Jubilee Hospital also said on X that its website was unavailable.

Many websites were operational again on Thursday morning.

Global threat

The cyber division of the National Security Agency in the US warned weaknesses in the software could provide “a direct path to the server’s file system or database”.

The Wall Street Journal reported that the flaw was discovered in August by Ryan Austin, a researcher at the cybersecurity company Calif, using an advanced AI model developed by OpenAI.

PHP developers had reportedly planned a security update on Thursday, but the release was brought forward after details of its work to address the vulnerabilities leaked online.

OpenAI, which runs ChatGPT, said in the past two months it has been leading a team of researchers working to address the critical flaw in PHP, and supported its developers as it led the fixes.

The company described the incident as “one of the most impactful security issues in recent memory”, adding that while AI can help to uncover issues, it can also aid attackers.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a defender’s window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” it said.