FSB Orders Critical Infrastructure Operators to Shutter Websites Over PHP Bug – RBC

Oct. 23, 2026 duma.gov.ru The FSB security service’s cybersecurity division has told Russia’s critical infrastructure operators to temporarily take down websites if they cannot immediately patch critical flaws in the PHP programming language that were uncovered using AI, the RBC outlet reported Thursday. Operators were ordered to apply emergency software patches, run full antivirus scans and report any suspicious activity. “Consider temporarily restricting external access to vulnerable web servers up to and including shutting them down,” the security alert reportedly stated. The FSB order applies to communication networks and information systems across government agencies, as well as financial, energy, transportation, medical and other companies. Its directive mirrors that of the U.S. National Security Agency, as well as authorities from the EU and China, after PHP programmers released a fix for the critical vulnerability on Wednesday. The flaws had been reported privately to PHP’s developers and kept confidential while a fix was prepared. Global firms and governments rushed on Thursday to patch PHP flaws as cloud firms reported a surge of hacking attempts after the vulnerabilities were disclosed. As companies and governments deployed patches and suspended websites as a precaution, hacking attempts surged into the millions, according to cloud services firm Cloudflare and Amazon. Tech experts warned in comments to RBC that “tens or hundreds of thousands” of Russian websites remain vulnerable to cyberattacks due to widespread reliance on PHP across the country. More than 90% of Russian-language websites and almost 70% of the web globally run on PHP, according to the W3Techs platform. AFP and Reuters contributed reporting. Read more about: FSB , Internet Sign up for our free weekly newsletter Our weekly newsletter contains a hand-picked selection of news, features, analysis and more from The Moscow Times. You will receive it in your mailbox every Friday. Never miss the latest news from Russia. Preview Subscribers agree to the Privacy Policy We sent a confirmation to your email. Please confirm your subscription. A Message from The Moscow Times: Dear readers, We are facing unprecedented challenges. Russia's Prosecutor General's Office has designated The Moscow Times as an "undesirable" organization, criminalizing our work and putting our staff at risk of prosecution. This follows our earlier unjust labeling as a "foreign agent." These actions are direct attempts to silence independent journalism in Russia. The authorities claim our work "discredits the decisions of the Russian leadership." We see things differently: we strive to provide accurate, unbiased reporting on Russia. We, the journalists of The Moscow Times, refuse to be silenced. But to continue our work, we need your help. Your support, no matter how small, makes a world of difference. If you can, please support us monthly starting from just $2. It's quick to set up, and every contribution makes a significant impact. By supporting The Moscow Times, you're defending open, independent journalism in the face of repression. Thank you for standing with us. Once Monthly Annual Continue Not ready to support today? Remind me later. × Remind me next month Remind me Thank you! Your reminder is set. We will send you one reminder email a month from now. For details on the personal data we collect and how it is used, please see our Privacy Policy. Read more Putin Orders FSB and Government to Make ‘Critical Services’ Available During Internet Outages Putin mandated that access to healthcare platforms, the Gosuslugi government services portal and electronic payment networks must remain available while... 1 Min read Russian Security Services Troll U.S. Embassy With July 4 Billboard “Welcome to our peaceful country,” read the billboard in the colors of the Russian flag, set against the backdrop of the Kremlin and St. Basil’s... 1 Min read Russia Fines Tech Giant Yandex 2M Rubles The company was found guilty of repeatedly refusing to hand over its user data to the Federal Security Service. 1 Min read Russia Claims Arrests in Ukrainian ‘Dirty Bomb’ Plot The FSB claimed that Ukraine’s military intelligence had set up a special unit to supply sabotage groups within Russia “and drop bombs on fuel and... 2 Min read