Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R04 Services lost to precautionary shutdowns / R04-1

R04-1: National government services offline

Because the Dutch, Finnish and Latvian governments restricted or switched off their own web services as a precaution, citizens lost access to identity, tax and emergency information, resulting in harm to people who needed them that day.

Rating 20 critical · Likelihood 5 Happening · Impact 4 Major · Kind Operational · Acceptance not recorded

Basis. Confirmed in the Netherlands and Latvia; reported in Finland.

The path

Told inphp2shell in perspectivephp2shell in perspec…Where php2shell standsWhere php2shell stan…Acted on byBoard and executivesBoard and executivesCommunications teamCommunications teamStory site agentStory site agentCarried byNational governments (owner)National governments…People who need a service that went offline (bearer)People who need a se…EU and member-state CERTs (informer)EU and member-state …RiskR04-1 National government services offlineR04-1 National gover…Arises fromNot knowing where PHP runsNot knowing where PH…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
National governmentsownerMade the call.1 risk
People who need a service that went offlinebearerLost DigiD, MijnOverheid, 112.lv.2 risks
EU and member-state CERTsinformerNCSC-NL and CERT.LV advised and acted.5 risks

What it arises from

The evidence

ClaimStatusFact-checkSources
The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesconfirmedA3 EchoedRijksoverheid / NCSC-NL Dutch IT Leaders
Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precautionreportedA2 ReportedYle Helsinki Times
Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCconfirmedA6 EstablishedCERT.LV

Treatments

TreatmentStatusWhere
Restrict access by geography instead of switching offpartialImpact: taken offline versus compromised

The standards that govern it

FrameworkControlWhat it asksFamily
NIS2Art.21(2)(c)Business continuity, backup management, disaster recovery and crisis managementLaw and regulation
ISO/IEC 27001A.5.29Information security during disruptionManagement-system standards
NIST CSF 2.0RC.RP-01The recovery portion of the incident response plan is executedFrameworks and control catalogues

The stories that tell it

On this site: Impact: taken offline versus compromised