NHS Scotland website down as critical security issue found

WEBSITES across the world – including in Scotland – have been taken down after critical cyber-security weaknesses were discovered.

The flaws were found within the PHP programming language, which powers much of the internet.

The vulnerabilities mean that an unauthorised person could gain remote access to any PHP-based website if a specific set of conditions are met.

File image of a laptop (Image: Archive)

While any such attack would be complex to carry out, the likelihood of these vulnerabilities being exploited increases with the use of AI.

A fix was issued on Wednesday afternoon, with organisations who are unable to address the issues in time urged to consider taking their sites down in the meantime.

Websites linked to the French, Danish, Finnish and Dutch governments are among those to appear to go offline on Wednesday afternoon in an attempt to protect their systems.

The NHS Scotland website is down at the time of writing, with a message saying the site is "currently undergoing scheduled maintenance".

A screenshot from the NHS Scotland website (Image: NHS Scotland)

Daniel Card, a cybersecurity expert at xServus, explained that 70% of sites across the internet run on PHP and "two critical unauthenticated remote code execution vulnerabilities were discovered".

Card said: "This discovery was leaked before patches were available or released and as such it’s been a shit storm. Some organisatoins have been told to pull offline, some have done so in panic.

"But this likely is chasing more impact than any baddies right now.”

He added: “The thing to remember, this space is fast paced, and dynamic. So what we think is ok might be proven wrong in X minutes."

Card said he expected organisations to "patch reasonably fast" but that this depends on their service”.

The City of Edinburgh Council website is also among those to be affected, with a similar notice issued that the site is "currently under maintenance".

A screenshot from the council's website (Image: City of Edinburgh Council)

LibDem MSP and Edinburgh councillor Sanne Dijkstra-Downie said: "The disruption to the City of Edinburgh Council website and the loss of access to some online services will be frustrating and concerning for residents, particularly those who rely on these services to manage essential day-to-day matters.

"Technical and security issues can require urgent action but the council will need to communicate clearly with residents how long it expects services to be offline. They must also guarantee that no one will be left out of pocket as a result of key services going down.

"They will also need to ensure that people who need urgent help are not left without support because a website or online form is unavailable, particularly for people who are vulnerable or facing urgent housing, financial or social care difficulties."

Dijkstra-Downie added: "As a councillor, I will be seeking clarity on the disruption, the arrangements for supporting affected residents, and the steps being taken to restore services securely and minimise the risk of similar disruption in future."

The National has approached the City of Edinburgh Council for .

A number of other Scottish councils also appear to be affected.

See the full list below.

Full list of Scottish councils impacted by critical cyber-security issue

Argyll and Bute Council

City of Edinburgh Council

Clackmannanshire Council

Perth and Kinross Council

A spokesperson for the National Cyber Security Centre said it is "encouraging UK organisations to prepare for immediate updating of systems using PHP".

They added: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."