Scottish public bodies shut websites after critical PHP flaw discovered using AI

Global patching effort underway after decade-old vulnerability exposed

By LineZotpaper

Published22 October 2026

Read Time2 min

A number of Scotland's councils and NHS boards took their websites offline this week as a precaution after security researchers uncovered critical vulnerabilities in PHP, a programming language used widely across the internet. The flaws, which had gone undetected for over a decade, were identified with the help of advanced AI tools and have prompted urgent patching by governments and organisations worldwide.

At least seven of Scotland's 32 councils and six of its 14 health boards temporarily suspended access to their websites on Wednesday evening after security updates were released for the PHP vulnerability. Some services were restored later that night.

The vulnerabilities were discovered by researchers at firms Calif and Wiz as part of an initiative called Patch the Planet, backed by OpenAI. The researchers used advanced AI tools to identify and analyse the flaws, which OpenAI described as 'one of the most impactful security issues in recent memory'.

Edinburgh councillor and MSP Sanne Dijkstra-Downie acknowledged the frustration for residents: 'Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline. It must also ensure that people who need urgent help can still access support while online services are unavailable.'

The global impact has been significant, with the Finnish government, the BBC, and other organisations also taking systems offline. Cybersecurity firm Wiz estimated roughly 70% of websites could be affected by the vulnerability, though that figure has not been independently confirmed.

Details of the flaw were leaked on social media on Tuesday, forcing the PHP Foundation to disclose the issue and issue a fix earlier than planned. The UK's National Cyber Security Centre (NCSC) urged organisations to apply the fixes immediately, advising: 'Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.'

The incident highlights the growing role of AI in discovering long-hidden security vulnerabilities, and the challenges of coordinating responses across public and private sectors.

Analysis

Why This Matters

The PHP vulnerability is estimated to affect roughly 70% of websites, making it one of the most widespread security flaws in recent years.
Public bodies in Scotland were forced to temporarily shut down online services, disrupting access to council and NHS information for residents.
The use of AI to discover the flaw signals a shift in cybersecurity, where advanced tools can uncover long-hidden vulnerabilities but also create new urgency in patch management.

Background

PHP is a scripting language used to build dynamic websites and web applications. It powers a large portion of the internet, including many government and public sector websites. The vulnerabilities lay undetected for more than a decade before being uncovered by researchers participating in OpenAI's Patch the Planet initiative, which gave them access to advanced AI analysis tools. The plan to announce the vulnerability alongside a patch later in October was disrupted when details were leaked on social media, forcing early disclosure.

Key Perspectives

Affected councils and NHS boards: Took the precautionary measure of taking websites offline to protect data and systems. They prioritised security but faced criticism over communication with residents. Residents and local representatives: Expressed frustration at interrupted services, while acknowledging the need for urgent security action. Call for clear updates and continued access to critical support. Cybersecurity researchers and OpenAI: Highlight the success of AI-assisted vulnerability discovery. The flaw was described as 'one of the most impactful security issues in recent memory'. NCSC and security agencies: Urged immediate patching and advised taking systems offline if fixes cannot be applied quickly.

What to Watch

Speed of patching across Scottish public bodies and global organisations.
Potential for similar discoveries of long-hidden vulnerabilities using AI tools.
Ongoing impact on trust in PHP-based websites and infrastructure.

Sources

Councils and NHS boards take websites offline after security alert · BBC Scotland

Checked

12 claims in this story checked against 1 source: 6 supported.

Show each claim

Partly supportedThe headline says Scottish public bodies shut websites after a critical PHP flaw was discovered using AI.BBC Scotland: “A number of Scotland's public bodies, including councils and health boards, took their websites offline after cyber-security flaws were identified in a programming language which underpins much of the internet. Researchers said AI-assisted analysis helped identify the flaws.”
SupportedA global patching effort is underway after a decade-old vulnerability was exposed.BBC Scotland: “The flaws had gone undetected for more than a decade ... Security updates were released on Wednesday, prompting governments and public bodies around the world to urge website operators to apply the fixes.”
SupportedThe vulnerabilities went undetected for over a decade and AI-assisted analysis helped identify them.BBC Scotland: “The flaws had gone undetected for more than a decade ... Researchers said AI-assisted analysis helped identify the flaws.”
Partly supportedThe vulnerabilities prompted urgent patching by governments and organisations worldwide.BBC Scotland: “Security updates were released on Wednesday, prompting governments and public bodies around the world to urge website operators to apply the fixes.”
SupportedAt least seven of Scotland’s 32 councils and six of its 14 health boards took their websites offline on Wednesday evening as a precaution.BBC Scotland: “At one point on Wednesday evening, at least seven of Scotland's 32 councils and six of its 14 health boards had taken their websites offline as a precaution.”
Partly supportedResearchers at Calif and Wiz discovered the vulnerabilities as part of Patch the Planet, an initiative backed by OpenAI.BBC Scotland: “The vulnerabilities were discovered by cyber-security researchers at the firms Calif and Wiz. Calif, along with PHP Foundation, were part of an initiative started by OpenAI called Patch the Planet.”
SupportedOpenAI called the discovery “one of the most impactful security issues in recent memory”.BBC Scotland: “OpenAI said in a blog post that the discovery was “one of the most impactful security issues in recent memory”.”
SupportedSanne Dijkstra-Downie said: “Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline. It must also ensure that people who need urgent help can still access support while online services are unavailable.”BBC Scotland: “She said: “Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline. “It must also ensure that people who need urgent help can still access support while online services are unavailable.””
Not in the sourcesThe Finnish government and the BBC also took systems offline.BBC Scotland: “The problem has affected public bodies and businesses around the world, including the Finnish government and the BBC.”
Partly supportedWiz estimated roughly 70% of websites could be affected, though that figure has not been independently confirmed.BBC Scotland: “Wiz estimated “roughly 70%” of websites are affected, though the BBC is unable to verify that figure.”
SupportedDetails of the flaw leaked on social media on Tuesday, prompting the PHP Foundation to disclose it and issue a fix earlier than planned.BBC Scotland: “However, details of the flaw were leaked on social media on Tuesday. The leak prompted the PHP Foundation to disclose the flaw and issue a fix earlier than planned.”
Partly supportedThe NCSC urged organisations to apply the fixes immediately and advised: “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.”BBC Scotland: “The UK's National Cyber Security Centre (NCSC), as well as its counterparts in the EU and Australia have urged those who use PHP to apply the fixes. “Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the NCSC said in a note.”