Edinburgh council among sites pulled offline worldwide as hackers race to exploit huge web flaw

Websites run by councils, governments and businesses around the world have been taken offline after a critical flaw was found in PHP, a programming language used to build almost 70% of the web.

In the UK, the websites of City of Edinburgh Council, Bristol City Council and Oxford City Council were among those taken down as precautions. In France, local government sites including that of the Paris police prefecture went offline, while in the Netherlands the national digital identity service, the House of Representatives website and the national cyber security centre’s own site were temporarily unavailable. Belgian, Finnish and German government websites were also affected.

The Australian Signals Directorate, the country’s cyber defence agency, said it had been temporarily affected overnight and that other government sites might have been too.

What has gone wrong

PHP is a free, open-source language more than 30 years old. It powers WordPress, one of the most widely used website systems, as well as Drupal, which runs many government sites, and services such as Wikipedia and the messaging tool Slack. The Wikimedia Foundation said it had taken several systems offline on Wednesday until they could be patched.

The PHP Foundation, the not-for-profit body that maintains the language, said the two vulnerabilities sat in parts of PHP that “nearly every request touches: memory management and error handling”. The security firm Hadrian nicknamed them “PHP2Shell”.

In simple terms, an attacker can send a specially crafted request that corrupts a website’s memory and then use it to take control. The US National Security Agency warned that the flaw could “provide a direct path to the server’s file system or database” – potentially exposing stored personal information.

Security agencies sound the alarm

The NSA told organisations to take PHP systems offline if they could not patch them immediately. The UK’s National Cyber Security Centre gave similar advice and urged organisations to check for “backdoors installed by an attacker” – hidden access points that could let criminals return even after a fix is applied.

The PHP Foundation issued a patch on Wednesday. The details were originally meant to stay secret until 22 October to give website owners time to prepare, but the foundation said it brought the announcement forward after information began circulating on forums and social media on Tuesday.

Amazon’s security chief, CJ Moses, said the company had detected an attempt to exploit the flaw against one of its decoy “honeypot” systems on 17 October – four days before it became public. He said it was unclear how the attacker had learned of it. The White House said it had been told about the problem on Friday.

A race against attackers

Experts say the danger now is that criminals can study the published fix to work out exactly how to attack sites that have not yet installed it – a task that AI tools can speed up dramatically. Hadrian said it was already seeing “exploitation happening at scale”.

Costin Raiu, co-founder of the cyber security firm TLP:Black, warned of a “race to exploit” and the risk of “mass compromise of every vulnerable web server on the internet”.

Prof Alan Woodward, a cyber security expert at the University of Surrey, said: “The troubling part is there is going to be a long tail of websites who may not be maintained as well and they are going to remain vulnerable, which means we may see weeks and months of ongoing attacks.”

The internet infrastructure expert Michał Woźniak said hijacked servers could be used to mine cryptocurrency or as launch pads for larger attacks, including by organised crime groups and Russian state-backed hackers.

Found with the help of AI

The flaw had been hidden in PHP’s code for more than a decade. Several groups said they had found it with the help of artificial intelligence. The security firm Calif said it discovered the problem with a large language model on 1 August, while Wiz, owned by Google’s parent company Alphabet, said its own AI research tool had also spotted it. OpenAI said it had led a coalition of researchers, and the PHP Foundation said it had used Anthropic’s AI to scan its code.

What you should do

Ordinary internet users do not need to install anything themselves, but experts advise caution. Sites that went offline to apply the fix are not the main worry, said Sigi Goode, a professor of information systems at the Australian National University. “The bigger concern is the websites that are not down today. Users should be wary of these, as they are clear targets.”

Small businesses, charities and community groups in Scotland that run their own WordPress or other PHP-based sites are being urged to update immediately or ask their web host to confirm the patch has been applied. As Hadrian put it: “Shutting down a service for a few hours costs far less than a compromised server.”