Several University of Edinburgh websites were taken offline this week as governments and cyber-security agencies worldwide urged organisations to fix two critical flaws in PHP, the programming language behind much of the internet, according to the BBC.
In an email to all students on Wednesday, information services said some university sites had been temporarily taken offline while essential updates were carried out. Some pages were expected to be unavailable overnight, but MyEd, Learn, and the university home page remained available.
The university said it was prioritising the services most critical to teaching, research and business. The email did not mention PHP, and the university has not confirmed a link.
The message arrived the day a fix was released. Finland shut its government’s public web services, the Netherlands’ cyber agency removed its own site, and the US National Security Agency advised anyone unable to update to go offline. An EU agency warned that websites may need to be taken offline while PHP prepared patches.
The flaws, undetected for more than a decade, were found using AI. Security firm Wiz estimates roughly 70 per cent of the internet is affected, a figure the BBC said it could not verify. CERT-EU warned the flaws could allow remote code execution without logging in, and Cloudflare reported early attacks.
It is not the first time a university has been forced to shut down systems. In 2021, Queen’s University Belfast suspended access to several systems after an attempted cyber attack that also affected the Belfast health trust. The university said there was “no evidence” any data had been stolen, while the National Cyber Security Centre said universities hold valuable data which can make them a lucrative target.
A recent government survey found attacks on higher education becoming more prevalent.
A student said “I noticed that the websites were down on Wednesday, and I made the connection to a news article I read that morning.”
The University of Edinburgh has not confirmed whether the maintenance was related to PHP, though it came on the same day a fix was released, suggesting a possible link.
The university advises students to keep devices updated and treat unexpected links with caution.
Photo by David Pupăză on Unsplash.
