Several websites operated by Northern Ireland departments have been taken offline after a critical security flaw was discovered in the programming language PHP.

Organisations across the UK have been advised to update to a patched version of PHP or consider taking their websites offline if they cannot be upgraded immediately, following guidance from the National Cyber Security Centre (NCSC).

The Office for Budget Responsibility (OBR) also took its website offline and said it had followed NCSC guidance "in view of the critical security issues affecting PHP."

PHP is used by almost 70% of websites, according to cybersecurity firm Cloudflare, and underpins popular platforms such as WordPress and Magento.

The security flaw could allow attackers to remotely control any web servers running PHP, giving them a direct path to the server's file system or database.

The NCSC urged all organisations, public and private, to update to the latest version of PHP as soon as possible.

A spokesperson for the UK Government said work is underway to identify and patch any potential exposure within government systems.

They encouraged all organisations to follow NCSC guidance to understand their exposure and take necessary actions to safeguard their systems.

The flaw was discovered in August by Ryan Austin, a researcher at cybersecurity company Calif, using an advanced AI model developed by OpenAI, according to the Wall Street Journal.

However, former NCSC head Ciaran Martin told Times Radio the vulnerability had actually been identified by human researchers in 2024, but was not patched because it was believed too complicated to exploit.

He said the flaw could lead to significant loss of personal data, including card details, and could make it easier for criminals to impersonate executives and carry out fraud.

Cloudflare chief executive Matthew Prince reported a dramatic surge in exploitation attempts after the flaw was announced, with millions of attempts ongoing.

Some BBC webpages and the Finnish government website were also affected, along with Oxford City Council and the City of Edinburgh Council.