The flaws were found within the PHP programming language, which powers much of the internet.
PHP is used by almost 70% of websites, according to cybersecurity firm Cloudflare, and underpins popular platforms such as WordPress and Magento.
READ MORE: Lesley Riddoch: Jackdaw won’t cut our bills – so why are we still hooked on gas?
Websites linked to the French, Danish, Finnish and Dutch governments are among those to appear to go offline on Wednesday afternoon in an attempt to protect their systems.
NHS Scotland, several NHS boards and at least eight councils have also been affected.
At the time of writing, the NHS Scotland website remains offline, with a message stating that the site is “undergoing scheduled maintenance”.
A screenshot from the NHS Scotland website (Image: NHS Scotland)
Meanwhile, websites linked to the French, Danish, Finnish and Dutch governments are among those which went offline on Wednesday afternoon in an attempt to protect their systems.
According to Cloudflare chief executive Matthew Prince, there was a dramatic surge in attempts to exploit the issue once it was announced.
He wrote on Twitter/X: “Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it.
“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”
The Office for Budget Responsibility (OBR) said it had followed guidance to take its website offline, “in view of the critical security issues affecting PHP”.
It is understood some of the UK Government’s online services may be temporarily unavailable while steps are taken to maintain security, but any impact is expected to be minimal.
Scottish Secretary Douglas Alexander has said the security of next week’s UK Government Budget has not been compromised by the critical security flaw.
He was asked whether the issues identified with PHP could result in major Budget leaks because the OBR had to take down its website.
Alexander told Times Radio: “No, I’ve had no indication whatsoever that there’s any problem in terms of a breach of Budget security.
“Indeed John Healey, who I was with yesterday in Scotland, as I understand it initiated new security protocols reflecting his experience in the Ministry of Defence when he came to the Treasury as Chancellor in the summer.”
READ MORE: Daniel Sloss issues statement addressing Vittorio Angleone ‘rape’ joke
Last year, the OBR’s Budget analysis was mistakenly published online ahead of then-chancellor’s Rachel Reeves statement to the Commons, allowing for early access to market sensitive information.
Organisations have been urged by the National Cyber Security Centre (NCSC) to update to a new, fixed version of the software.
If software cannot be immediately upgraded, organisations should consider taking their websites offline, the NCSC said.
A UK Government spokesperson said: “Work is already under way across Government to actively identify and patch any potential exposure.
“We encourage all organisations, private and public, large and small, to follow guidance issued by the NCSC to understand their exposure and take the necessary actions to safeguard their systems.”
An expert has also warned that the flaw in the PHP programming language was revealed “earlier than it was supposed to have been”, which means hackers started checking websites to see if they could exploit the vulnerability.
Speaking to BBC Radio 4’s Today programme, computer science professor Alan Woodward said: “The cat was let out of the bag rather earlier than it was supposed to have been.
“There was an embargo on this, and there’s always a window between the flaw being publicly known about and it being patched so that the attackers can’t successfully get in.
“And what happened, unfortunately, the day before the patch was out, somebody let the cat out of the bag.
“There was an initial version of the patch that was released, and so it was very easy to compare the original with the patched version and see which bit of code you needed to go and exploit.
“And that people like Amazon, Cloudflare, all sorts of companies that monitor what’s going on on the web, saw that this was being probed for.
He added: “We don’t know whether it’s being attacked, but certainly people were probing websites to see have you got that flaw?”
NHS Scotland has been contacted for comment.