Some CSC services temporarily taken offline as a precaution due to PHP vulnerabilities
Two critical vulnerabilities have been discovered in the widely used PHP software platform used for implementing web services. Security patches addressing these vulnerabilities have not yet been released. The National Cyber Security Centre Finland (NCSC-FI) announced the issue on the morning of 21 October 2026.
The updated version will be deployed as soon as possible after its release in all environments where PHP is in use.
As a precautionary measure, we have temporarily shut down some of our services. The purpose of this action is to protect the services until the required security updates have been installed. The service interruption is not due to any known incidents where these vulnerabilities have been exploited in our environment.
We are communicating directly with the responsible contacts of the services that have been taken offline as a precautionary measure.
PHP (Hypertext Preprocessor) is one of the world’s most widely used server-side programming languages and powers a significant proportion of internet websites. We will apply the updates immediately after they are released and aim to restore all affected services to normal operation as quickly as possible.