Councils and NHS boards take websites offline after security alert
Getty ImagesA number of Scotland's public bodies, including councils and health boards, have taken their websites offline after cyber-security flaws were identified in a programming language which underpins much of the internet.
The vulnerabilities were discovered by cyber-security researchers after apparently remaining undetected for years. Researchers said AI-assisted analysis helped identify the flaws.
Security updates were released on Wednesday, prompting governments and public bodies around the world to urge website operators to apply the fixes.
Several councils, NHS boards and other organisations, including the Care Inspectorate, were among those that temporarily suspended access to their websites.
Which websites have been affected?
The problem has affected public bodies and businesses around the world, including the Finnish government and the BBC.
At one point on Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards had taken their websites offline as a precaution.
In some cases, the disruption to online services was temporary and they were restored later in the evening. The public bodies still affected at 22:00 were:
- City of Edinburgh Council
- Highland Council
- Orkney Islands Council
- Care Inspectorate
- Bòrd na Gàidhlig - a public body promoting Gaelic development
Sanne Dijkstra-Downie, an Edinburgh councillor and MSP for Edinburgh Northern, said the loss of access to online services would be frustrating for residents.
She said: "Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline.
"It must also ensure that people who need urgent help can still access support while online services are unavailable."
Who found the problem?
The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz.
Calif, along with PHP Foundation, were part of an initiative started by OpenAI called Patch the Planet.
As part of this, researchers were given access to advanced AI tools to help identify and analyse vulnerabilities in PHP.
OpenAI said in a blog post that the discovery was "one of the most impactful security issues in recent memory". It added that an internal researcher at the company had also discovered the issue at around the same time as the other firms.
The flaws had gone undetected for more than a decade but by August, after a few weeks of using advanced AI tools, they were discovered.
Wiz estimated "roughly 70%" of websites are affected, though the BBC is unable to verify that figure.
The PHP Foundation had planned to announce the vulnerability later this month alongside a software patch. However, details of the flaw were leaked on social media on Tuesday.
The leak prompted the PHP Foundation to disclose the flaw and issue a fix earlier than planned.
The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes.
"Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated," the NCSC said in a note.