Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R04

R04: Services lost to precautionary shutdowns

Because agencies advised taking systems offline where an update was not possible, governments, councils and companies switched off services people rely on, resulting in an outage caused by the defence rather than by an attack.

Rating 20 critical · Likelihood 5 Happening · Impact 4 Major · Kind Operational · Acceptance not recorded

Basis. It happened: the Netherlands, Finland, Latvia, UK councils and the Wikimedia Foundation took services offline.

The path

Told inphp2shell in perspectivephp2shell in perspec…Where php2shell standsWhere php2shell stan…Acted on byBoard and executivesBoard and executivesCommunications teamCommunications teamStory site agentStory site agentCarried byGovernments and public services (owner)Governments and publ…People who need a service that went offline (bearer)People who need a se…Agencies and CERTs (source)Agencies and CERTs (…Board and executives (owner)Board and executives…Communications team (treater)Communications team …RiskR04 Services lost to precautionary shutdownsR04 Services lost to…Arises fromPHP versions the project no longer fixesPHP versions the pro…Not knowing where PHP runsNot knowing where PH…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
Governments and public servicesownerTook the decisions.3 risks
People who need a service that went offlinebearerLost the services.2 risks
Agencies and CERTssourceTheir advice drove the decisions.11 risks
Board and executivesownerThe offline call is a board-level call.5 risks
Communications teamtreaterExplains the outage.2 risks

The risks this one is made of

RiskRatingKindAssigned toControls
R04-1 National government services offline20 criticalOperationalNational governments owner, People who need a service that went offline bearer, EU and member-state CERTs informerNIS2 Art.21(2)(c), ISO/IEC 27001 A.5.29, NIST CSF 2.0 RC.RP-01
R04-2 Councils and police offline without saying why15 highReputationalLocal councils owner, Communications team treater, UK NCSC informerCyber Essentials SUM, NIST CSF 2.0 RS.CO-03, ISO/IEC 27001 A.5.24
R04-3 The agencies' advice disagrees12 highGovernanceAgencies and CERTs source, Board and executives owner, The press informerISO/IEC 27001 A.5.5, NIST CSF 2.0 GV.RR-01, NIS2 Art.20

What it arises from

The evidence

ClaimStatusFact-checkSources
If an immediate update is not feasible, take the system offline until it can be fully mitigatedconfirmedA6 EstablishedNSA Cyber on X NSA
Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PHP-based systems offlineconfirmedA6 EstablishedCISA
The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesconfirmedA3 EchoedRijksoverheid / NCSC-NL Dutch IT Leaders
Finland's state IT provider Valtori restricted public traffic to government web services from 12:45 local time on 21 October as a precautionreportedA2 ReportedYle Helsinki Times
Latvia restricted access from abroad to several state digital resources, possibly until 26 October; lsm.lv and 112.lv were restored by 20:00 UTCconfirmedA6 EstablishedCERT.LV
Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, online shops and the BBC were affected or taken offlinereportedA2 ReportedBBC News
The Wikimedia Foundation took down a number of systems 'as a precautionary measure until they can be safely patched'reportedA4 CorroboratedCNN The Cyber Express

Treatments

TreatmentStatusWhere
Serve from cache while the origin is patchedpartialImpact: taken offline versus compromised
A continuity plan that names which services may go darkmissingImpact: taken offline versus compromised

The standards that govern it

FrameworkControlWhat it asksFamily
ISO/IEC 27001A.5.29Information security during disruptionManagement-system standards
ISO/IEC 27001A.5.30ICT readiness for business continuityManagement-system standards
NIS2Art.21(2)(c)Business continuity, backup management, disaster recovery and crisis managementLaw and regulation
DORAArt.11Response and recovery, including ICT business continuityLaw and regulation
NIST SP 800-53CP-2Contingency planFrameworks and control catalogues
NIST CSF 2.0RC.RP-01The recovery portion of the incident response plan is executedFrameworks and control catalogues

The stories that tell it

On this site: Impact: taken offline versus compromised · What sixteen agencies actually advise