On Wednesday evening, as security updates arrived for a programming language that underpins much of the web, IT teams across Scotland made a decision most patients would only notice when it reached them. Six of the country's 14 health boards and at least seven of its 32 councils switched their websites off. By ten o'clock the health board sites had returned, but Edinburgh, Highland and Orkney councils and the Care Inspectorate were still dark. Nobody had been attacked. Everybody had been warned.

The flaws sat in PHP and went undetected for more than a decade, until researchers given advanced AI tools found them within weeks. One security firm estimates that roughly 70 per cent of websites are affected, a figure that has not been independently verified. Details leaked before the planned announcement, forcing an early patch. The National Cyber Security Centre advised that where immediate remediation was not feasible, systems should come offline. The boards that complied made the correct call.

The relevance to the NHS is structural. Websites are not clinical systems, and the shutdowns were precautionary. Yet the episode shows how the economics of vulnerability discovery have shifted. Flaws that survived years of human scrutiny fell quickly once machines did the reading. The same tools are available to defenders and attackers alike, and the interval between a weakness being found and being exploited is likely to keep narrowing. Disclosure will arrive in clusters, often at inconvenient hours, and the organisations that cope will be those that can act within a day.

The NHS is poorly configured for that tempo. It comprises hundreds of separate organisations, each with its own web presence, content management arrangements and contractors. Many sites are maintained by small teams or outside suppliers whose patching timetables the trust or board does not control. The 2024 ransomware attack on a London pathology provider demonstrated how a single supplier failure can postpone thousands of appointments and operations. A web server running unpatched software is a less dramatic problem, but it follows the same logic of dependency.

Capacity is the harder issue. Cyber and digital teams compete for attention and money with waiting list recovery, financial recovery plans and the daily pressure of urgent care. Patching at short notice means pulling skilled staff from other work, and few organisations carry slack for that. Scottish boards have a devolved structure, but the same pressures run through NHS England trusts and the wider public sector. The councils caught up on Wednesday also host adult social care referrals, which makes the exposure plainly cross-sector.

The political stakes are rising because the state is asking more of its digital front door. Ministers have made the NHS App and online access central to their reform plans for appointments, records and communication. Each service migrated online raises the cost of a site going dark. An Edinburgh councillor made the right demand on Wednesday: clear communication about how long services will be unavailable, and a guarantee that people needing urgent help can still reach it. That should be a standard written into every organisation's continuity plan, tested before the day it is needed.

For NHS leaders, the immediate priorities are practical rather than headline-grabbing. Trust boards need an up-to-date inventory of the software supporting their public-facing services, including systems operated by third-party suppliers on their behalf. Contracts should specify how fast suppliers must patch and how quickly they must report. Offline fallbacks for booking, triage advice and social care contact need rehearsal, with telephone routes staffed and publicised. Policymakers designing cyber resilience legislation for critical services should treat health suppliers as firmly in scope and fund the capacity to comply.

The Scottish sites came back within hours. That is the reassuring reading, and it should be kept in proportion. The next flaw may sit in software that cannot be switched off for an evening, and the tools that found this one will be searching for it already.

‍