Governments took citizen services offline before the PHP fix existed, on the strength of an advisory that said to

On 21 October the NSA published advice on the two PHP flaws that is rarer than it sounds: update, and where an immediate update is not possible, take the system offline until the problem is fully fixed.

Several European governments did exactly that, and did it before a patched release existed.

What the advisory said

The agency's framing put the blame where it belonged: "These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration." That sentence matters because the usual first move after an advisory is to ask whether your configuration saves you. For CVE-2026-109618 and CVE-2026-109619, both scored 9.2, it did not.

The fix was a new PHP build, and until that build existed the only control available was switching the service off.

Who went dark

Reports name government bodies in 6 countries — the Netherlands, France, Finland, Denmark, Belgium and the Czech Republic — and the counts differ between accounts.

The Dutch shutdowns were the most extensive. 3 services went offline: MijnOverheid, the central citizen portal; DigiD, the national digital identity system; and the official site of the House of Representatives. DigiD is how people in the Netherlands log in to tax, health and municipal services, so taking it down takes down the front door to the state.

Every shutdown reported so far was described as precautionary. None followed a known compromise.

The order of events is the point

The patched PHP releases went live at around 13:45 GMT on the Wednesday. Agencies in the Netherlands and Finland had already pulled services offline before that. So a government looked at an advisory describing an unauthenticated remote code execution flaw in the engine under its public services, with no patch yet in existence, and chose hours of unavailability over hours of exposure.

Whether that was right depends on a judgement nobody can make from outside: how reachable those services were, what sat behind them, and how quickly they could have patched once a build existed. What is unusual is that the decision was made at all. The default in most organisations, public and private, is to wait for the fix and hope.

The cost nobody prices

An outage has a visible cost and a named owner. A compromise has neither until later. A citizen who cannot renew a permit today will complain today; a citizen whose records were read quietly in October may never know, and the official who left the service running will not be named as the cause. 0 of these shutdowns was followed by a reported compromise, and that is not evidence the decision was wrong.

Every incentive in a public body points at staying up, which is why these shutdowns are worth recording even though nothing happened. The counterfactual is unknowable and the decision was still the harder one.

We wrote about what the PHP numbers actually count and about the four leaks inside the embargo. This is the other half: what the people responsible for public services did while that was going on.

What to do

• If you run public-facing services, write down now what your threshold is for taking something offline. Deciding during an incident means deciding under pressure.
• Identify which of your services have no degraded mode. DigiD has no partial version; it is up or it is not, and knowing that in advance changes the conversation.
• Keep the NSA's framing handy for the next advisory. When a flaw is in the runtime rather than the application, configuration review is not a mitigation and reviewing it wastes the window.
• If you took something offline during this and nothing happened, record why you did it. That record is what makes the next decision easier.

What is not established

• The authoritative list of which governments took which services offline. Accounts differ and no central list exists.
• Whether any of those services were actually targeted.
• How long each outage lasted.
• Whether the decisions were coordinated between countries or taken independently.
• What the NSA knew that was not in the public advisory, if anything.

The NSA's advisory page was not retrieved for this piece; the quotation above is as the reporting carries it.