A significant number of Scotland's public bodies, including local authorities and health boards, have temporarily suspended access to their websites following the identification of serious cyber-security vulnerabilities in PHP, a programming language that powers a substantial portion of internet infrastructure.
The flaws were uncovered by cyber-security researchers after remaining hidden for over a decade, with artificial intelligence-assisted analysis playing a crucial role in their detection. According to BBC News, security patches were released on Wednesday, leading governments and public bodies worldwide to issue urgent directives for website operators to implement the fixes immediately.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 according to the EU's cybersecurity authority, each carry a severity rating of 9.2 and can enable unauthenticated remote code execution. The EU's cybersecurity agencies and law-enforcement bodies issued a joint call for organisations to act immediately, prioritising internet-facing systems and isolating those that cannot yet be patched.
Which Scottish organisations were affected?
At least seven of Scotland's 32 councils and six of its 14 health boards had taken their websites offline as a precautionary measure by Wednesday evening. Six health board websites were down late on Wednesday but have since been brought back online.
The disruption extended beyond Scotland's borders, affecting public bodies and businesses globally, including the Finnish government and the BBC. Several Scottish organisations remained offline at 22:00 on Wednesday, including Bòrd na Gàidhlig, a public body dedicated to promoting Gaelic language development. In many cases, the suspension of online services proved temporary, with websites being restored later that evening.
Sanne Dijkstra-Downie, an Edinburgh councillor and MSP for Edinburgh Northern, highlighted the impact on residents.
Technical and security issues can require urgent action, but the council will need to communicate clearly with residents about how long it expects services to be offline. It must also ensure that people who need urgent help can still access support while online services are unavailable.
Who discovered these vulnerabilities?
Researchers at the cyber-security firms Calif and Wiz identified the flaws, with Calif and the PHP Foundation participating in an initiative launched by OpenAI called Patch the Planet. Through this programme, researchers gained access to advanced artificial intelligence tools designed to identify and analyse vulnerabilities within PHP code.
OpenAI characterised the discovery in a blog post as
one of the most impactful security issues in recent memory, noting that an internal researcher at the company had independently discovered the same issue at approximately the same time as the external firms. The vulnerabilities had evaded detection for more than a decade before being uncovered within weeks of deploying advanced AI analysis tools.
Wiz estimated that approximately 70% of websites globally are affected by these flaws, though this figure has not been independently verified. The PHP Foundation had originally scheduled an announcement of the vulnerability later in the month alongside a software patch. However, when details of the flaw were leaked on social media on Tuesday, the Foundation accelerated its disclosure and released the fix ahead of schedule.
What are the available fixes?
The PHP fixes are available in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with PHP 8.1 and earlier versions no longer receiving project updates. The PHP flaws affect versions dating back to PHP 5.4, according to Google Cloud's analysis of the vulnerabilities.
The UK's National Cyber Security Centre (NCSC), along with its counterparts in the European Union and Australia, has urged all organisations using PHP to apply the security updates. The NCSC stated:
Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.
What should organisations do next?
Organisations are advised to identify all PHP-based applications in their infrastructure, coordinate with hosting providers, and install the available fixes, beginning with systems that face the internet. Systems that cannot be patched promptly should be isolated from public networks to prevent potential exploitation by threat actors.
Key Facts
- Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were discovered after remaining undetected for over a decade
- Artificial intelligence tools developed by OpenAI enabled researchers at Calif and Wiz to identify the flaws within weeks
- An estimated 70% of websites globally may be affected by these vulnerabilities
- Security patches are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with older versions no longer receiving updates
- Multiple governments and cybersecurity agencies worldwide have urged immediate patching or offline status for vulnerable systems
