Following warnings from the National Cyber Security Centre, Oxfordshire County Council and Oxford City Council briefly took their websites offline on October 21 because of a critical safety issue affecting organisations worldwide.
Both authorities confirmed that their sites had returned online, although some changes could take time to appear and a holding page might remain visible temporarily.
The council said it had taken several web services offline while teams worked to resolve a known global problem.
The disruption affected access to council information, payments and other public services.
Oxfordshire County Council’s main site remained unavailable for several hours.
It provided an interim page covering urgent needs, including safeguarding, schools, permits and HWRC bookings.
Before the interim site appeared, visitors to the council website received an error alongside a Google warning that attackers might attempt to steal information such as passwords, messages or credit card details.
The authority stated that multiple online services had been withdrawn temporarily while the wider technical issue was addressed.
The National Cyber Security Centre had advised organisations running websites built with PHP to introduce temporary protections or remove their systems from service until the security flaw could be addressed.
The vulnerability offered attackers an opportunity to alter websites and exploit them.
A warning from the US cyber security agency noted that such weaknesses can sometimes lead directly to a server’s file system or database.
The fault also resulted in the Finnish Government, the Netherlands’ cyber-security agency and parts of Wikipedia being taken offline.
Online pages for BBC programmes, including Doctor Who and The Traitors, were similarly affected.
Oxford City Council’s website was also inaccessible during the incident.
The service normally supports council tax and business-rate payments, planning applications, housing services, bin collections and leisure provisions.
A correction for the PHP issue was subsequently made available.
According to the National Cyber Security Centre, every version of PHP was affected, and organisations were strongly advised to install the latest fixed release.
Those operating earlier versions were urged to move to a fully supported version.
A Government spokesperson confirmed that work had begun across public institutions to identify and patch possible exposure.
Organisations in the public and private sectors were advised to follow NCSC guidance, assess their systems and take the required action to protect them.
Cybersecurity firm Cloudflare estimates that around 70 per cent of websites use PHP.