Public Bodies in Scotland Take Websites Offline Due to PHP Vulnerabilities

• •Critical vulnerabilities in PHP discovered, affecting 70% of websites globally.
• •Public bodies in Scotland, including councils and NHS boards, took their sites offline as a precaution.
• •Security updates were released on October 21, 2026, following a leak of vulnerability details.

On October 21, 2026, several public bodies in Scotland, including councils and NHS boards, took their websites offline following the discovery of critical vulnerabilities in the PHP programming language. These vulnerabilities, identified by researchers at Calif and Wiz, had remained undetected for over a decade and were revealed through AI-assisted analysis. The UK's National Cyber Security Centre (NCSC) and other global agencies advised website operators to apply security updates released on the same day. Affected organizations included the City of Edinburgh Council and Orkney Islands Council, with at least seven councils and six health boards temporarily suspending online services. The PHP Foundation had planned to announce these vulnerabilities later but expedited the disclosure due to a leak on social media. The vulnerabilities are estimated to impact approximately 70% of websites globally, raising significant concerns about potential exploitation. As of the evening of October 21, some websites remained offline while others were restored after applying the necessary fixes.