Councils take websites offline following AI-discovered cyber security flaw
- Details
At least three local authorities have temporarily taken their websites offline following the discovery of a major cyber security vulnerability, which has also disrupted dozens of central government services.
According to the BBC, at least seven of Scotland's 32 councils and six of its 14 health boards had taken their websites offline on Wednesday while implementing fixes to a flaw in the programming language PHP, which is estimated to power around 70% of websites.
Oxford City Council also reportedly briefly took its website offline, while Ashford Borough Council warned residents on Thursday that some online services may not be functioning while the council implements its own security fixes.
Ashford stressed that the measures were proactive and that its websites and systems were operating as normal, and that customer data was safe.
The disruption follows the publication of a security update on Wednesday (21 October), warning that the vulnerability could allow attackers to execute commands on web servers running PHP.
The National Cyber Security Centre (NCSC) subsequently urged UK organisations to take immediate action by updating to the latest version of PHP.
It also recommended taking affected systems offline where organisations were unable to implement the necessary fixes immediately.
In a statement, Ashford Borough Council warned that some of its online services would be unavailable while its IT team implemented mitigation measures in line with NCSC guidance.
The vulnerability has also caused widespread disruption across central government, with ministers confirming on Thursday (22 October) that 32 government services had been taken offline and a further four were partially unavailable.
Speaking in Parliament, Baroness Lloyd of Effra said the disruption was largely the result of precautionary measures taken to protect systems while security updates were applied.
She said: "We are working very carefully with departments to restore the services safely and securely following that remediation activity. The advice of the NCSC is to mitigate and then restore the services. We are working to restore the services safely and as quickly as possible."
The minister added that the Government was not aware of any confirmed compromise of central government systems resulting from the vulnerabilities.
She also revealed that the NCSC had been briefed on the PHP vulnerability by OpenAI, the company behind ChatGPT, the previous week.
The centre had subsequently worked to ensure the vulnerability was disclosed in a coordinated manner with vendors, allowing sufficient time for organisations to prepare protective measures, she said.
Baroness Lloyd of Effra also encouraged organisations to sign up to the NCSC's early warning scheme, revealing that the centre had issued 50,000 proactive notifications to businesses and other organisations advising them on the action they should take.
The disruption comes amid growing concerns about the speed at which artificial intelligence is uncovering previously unidentified security vulnerabilities.
The Government's AI Minister, Kanishka Narayan, said that an earlier AI-assisted examination of government systems had uncovered 500 cyber security vulnerabilities.
"These are novel vulnerabilities that we discovered in significant areas of the public sector," he said.
Narayan argued that the Government should proactively use AI to identify and address security risks.
Meanwhile, Jason Clinton, deputy chief information security officer at AI company Anthropic, warned that the cyber security challenges posed by the technology were likely to intensify.
In a social media post, he said: "As bad as things have gotten in the past four days, they are going to get a lot worse before they get better. Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now."
His recent comments follow a warning he made in August of a potential "vulnerability tsunami", in which AI systems uncover critical security flaws faster than organisations can patch them.
Adam Carey
Jobs
Senior Legal Adviser (General Counsel Advice)
Directory
