Government pulls school and public websites offline to fix security flaws

All school websites on the island, and a number of other public-facing government sites, have been switched off so that urgent security patches can be installed. The Isle of Man Government gave confirmation on Wednesday afternoon.

The government said the sites were “temporarily taken offline as a precaution” after guidance was issued by the UK’s National Cyber Security Centre (NCSC). They will remain unavailable until work to resolve “identified vulnerabilities” has been finished, it said.

As well as every school’s site, the shutdown covers:

• the Isle of Man Legislation site
• the Isle of Man Post Office website
• the Read the Signs site
• the iMuseum
• the service giving live information on traffic and the roads

The government’s initial statement referred only to schools. Energy FM and Isle of Man Today later reported that it had confirmed the other sites were affected too.

The government said sorry for any disruption caused. Energy FM reported that it promised a further update once the fixes were in place and the sites were safe to restore. According to 3FM, the government also apologised in a Facebook post and expressed hope that the work would be completed shortly.

The move follows international alerts about two critical weaknesses identified in PHP, a programming language that underpins a large share of websites.

Isle of Man Today reported that an NCSC alert on Wednesday 21 October told organisations relying on PHP to be prepared to install patches the moment they were released. Where the problems could not be tackled immediately, the alert suggested organisations think about disconnecting vulnerable systems until they had been made safe.

Reports cited by Isle of Man Today said cyber security researchers had uncovered the flaws with the help of artificial intelligence. According to the same reports, the weaknesses might allow attackers to get into systems and data.

Citing the BBC, Isle of Man Today said cyber security agencies, the NCSC among them, had called on organisations to patch urgently. It also cited Reuters, which reported that similar precautionary shutdowns had affected public service sites around Europe, including those run by governments and education bodies. Isle of Man Today pointed out that not all organisations pulling sites offline have confirmed a connection with the PHP flaws.

The government has not stated whether its action is directly linked to the PHP vulnerabilities. According to Isle of Man Today, it has also not confirmed whether each of the affected sites runs a vulnerable version of the language.

Nor has the government said that any of its systems have been compromised.

There is no indication yet of when the websites will be back online.