Edinburgh City Council’s website was taken offline this afternoon after a critical cybersecurity flaw forced online shutdowns worldwide.

Two critical flaws in PHP – software that underpins a large share of the world’s websites – sent operators across the UK and Europe scrambling to protect their systems.

Council officials in Edinburgh made the decision to temporarily suspend online services ‘for maintenance’ while it sought assurances from its service provider.

A spokesperson for the City of Edinburgh Council said it was waiting on an update from its provider and hoped to have the website back up and running ‘as soon as possible’.

Oxford City Council, the Metropolitan Police website and the online home of the BBC’s The Traitors were also affected, while error messages appeared on the Bristol, Lambeth and Barnet local authority sites.

PHP is a piece of free, open-source scripting language that runs quietly behind a vast share of the world’s websites.

Security experts rated the two newly found flaws 9.2 out of 10 for severity. The EU’s cyber emergency response team warned they could let an attacker take control of a website’s server and run their own commands on it, without needing a password or any legitimate access.

PHP’s developers released a fix on Wednesday afternoon and urged website owners to install it without delay, advice that was echoed by Britain’s National Cyber Security Centre.

Because PHP sits beneath so much of the internet – including sites built with popular tools such as WordPress – the potential reach is enormous, and officials warned that versions dating back more than a decade could be exploited.

Government websites across Europe went dark on Wednesday as the disclosure sent operators rushing to shield their systems, with agencies in the Netherlands and Finland among those that took sites offline ahead of the fix. The Dutch national cyber security agency’s own website was pulled down as a precaution.

Automattic, the company behind WordPress.com, said it had been working with the PHP security team to ensure a smooth update. The firm said: “We don’t comment on the details of security issues, but our team is prepared and has been working with the PHP security team to ensure a smooth update.”

The NCSC further urged UK organisations to prepare for ’emergency updates’, advising that where immediate remediation was not feasible, they should consider taking the affected system offline until it could be fully mitigated.

A Scottish Government spokesperson added:“The Scottish Cyber Coordination Centre (SC3) is co-ordinating across the Scottish public sector.

“SC3 has passed on guidance to all public sector bodies from the National Cyber Security Centre which advises organisations on their response, including guidance to implement the patch issued earlier today.”