Widespread disruption that shut down authorities' online services continues – Valtori: Fixing it could take up to weeks

Several Finnish public online services were disrupted after critical vulnerabilities were found in PHP, the software used to build websites. Affected services included Maanmittauslaitos, Ilmatieteen laitos and the Ministry of Justice’s oikeus.fi website. The disruption reached more widely across government online services.

Valtori, Finland’s government information and communications technology centre, shut services temporarily on Wednesday. Closing them reduced the chance that attackers could use the PHP flaws to break into systems. The article reports no evidence of successful attacks or attempted exploitation, but the vulnerabilities were considered serious enough to justify immediate protection.

Some services remained unavailable while systems were updated and tested. Valtori’s director general said restoring all government services could take days or even weeks. Yle’s affected services returned on Wednesday evening, but the wider government recovery depended on how many systems needed larger updates and testing.

PHP is a programming language used to build websites. It runs the instructions that help a website produce pages and respond to visitors. The article focuses on PHP because critical vulnerabilities were discovered in the software, creating a security problem for services that depended on it.

PHP is used widely because it is designed for web development and can create pages that change according to requests, data or user actions. This makes it suitable for ordinary websites as well as more complex online services. Those broader uses help explain why a weakness in PHP can affect many different systems at once.

The article does not describe PHP’s technical design in detail, but it reports that PHP is used on websites around the world. A security update correcting the vulnerabilities was released on Wednesday afternoon. Organisations had to update their systems, test the changes and sometimes temporarily close services while doing so.

The problem was global, not limited to Finland. Cybersecurity centres around the world urged companies and government organisations to close online services temporarily because of the vulnerabilities. The warning showed that the issue could affect many kinds of operators and services at the same time.

Security company Wiz estimated that the vulnerabilities had affected as many as 70 percent of websites worldwide. The article does not provide a precise count of websites. Instead, the percentage gives the clearest indication of the possible scale. Axiom described the vulnerabilities as one of the most significant security problems in recent times.

A patch was released on Wednesday afternoon. Organisations then had to determine whether their systems used affected PHP components, apply the update and test their services. In Finland, Valtori said the work across government systems could take days or even weeks, showing how a global software flaw can create lengthy local disruptions.

A software vulnerability is a weakness that an attacker may try to use against a system. If a critical flaw is exploited, the attacker could gain unauthorised access or interfere with an online service. The article describes this risk as possible data breaches, which is why organisations treated the PHP findings as an urgent security problem.

The article does not describe a specific attack or stolen data. Instead, it says there was no evidence of successful exploitation or even attempts to exploit the vulnerabilities in the affected Finnish services. That absence of evidence did not remove the danger. A known critical weakness can still expose services while operators are preparing a fix.

The practical response was temporary closure, followed by updates and testing. Valtori called shutting services an effective protective measure. Once systems are safely updated and checked, services can return. The timing depends on how extensive each system’s changes are and how much testing those changes require.

Valtori shut services proactively because critical PHP vulnerabilities created a serious possibility of attack. Waiting for evidence of a break-in could have allowed attackers to exploit exposed systems first. Temporary closure reduced the services’ exposure while organisations prepared and tested corrective updates.

The article states that there was no evidence of exploitation or attempts to exploit the flaws. Even so, the problems were unusually broad. Cybersecurity centres worldwide advised companies and government organisations to close online services temporarily. Valtori’s director general described the shutdown as an effective protection measure.

This decision caused outages, but it also bought time for safer repairs. Valtori updated its own systems overnight and said its internal processes were working. It then focused on supporting customers. Government services could return only after necessary updates and testing, with recovery taking days or weeks in some cases.

A security update is not always a single quick installation across an entire organisation. Government services may use different systems, configurations and connected components. Each one must be checked to see whether it needs the update, whether broader changes are necessary and whether the service still works afterward.

Valtori’s director general said the schedule depended on how many systems required larger updates and how much testing those updates needed. Valtori had already updated its own systems overnight, but applying changes across the full mass of government information systems took longer. Testing helps identify problems before services are reopened.

That process explains the uneven recovery. Some services could return quickly, while others remained closed. Valtori said all government online services might take days or even weeks to restore normally. Yle’s affected services, by contrast, were restored during Wednesday evening and were then working normally.

A software vulnerability is a weakness in a program that may let an attacker compromise the system using it. Critical vulnerabilities matter because they can threaten many services at once, especially when the same software is used widely. In this case, the weakness was found in PHP, a language used to build websites.

A security patch is an update designed to correct the vulnerable software. Applying it changes the affected systems so the known weakness is addressed, reducing the opportunity for an attacker to use it. The article says a patch for the PHP vulnerabilities was released on Wednesday afternoon.

The patch still needs careful deployment. Organisations must identify affected systems, apply the update and test services, particularly where larger changes are required. Valtori said this work could take days or weeks across government. Temporary shutdowns provided protection while those repairs were completed.