FSB Orders Critical Infrastructure Operators to Shutter Websites Over PHP Bug – RBC

The emergency measure was to isolate vulnerable websites from the outside world. The FSB security alert told critical-infrastructure operators to restrict external access when they could not quickly install patches, up to and including shutting servers down. This matters because an exposed server could remain reachable while a serious flaw is still open.

Operators were also ordered to apply emergency software updates, run full antivirus scans and report suspicious activity. Together, these steps aimed to find or block attacks while organizations repaired affected PHP systems. A website could therefore be temporarily suspended rather than left openly accessible.

The warning covered government systems and companies in communications, finance, energy, transport, healthcare and other sectors. The article reports that tens or hundreds of thousands of Russian websites might remain vulnerable because PHP is widely used. Temporary shutdowns reduce exposure, but they can also interrupt public and business services.

PHP is a programming language commonly used to create web applications and generate website content. The source identifies it as a programming language, while this broader description uses established technical knowledge. A vulnerability in PHP can matter widely because many websites depend on the language to process requests and deliver pages or services.

The mechanism is broad rather than limited to one company. If vulnerable PHP code runs on a web server, an attacker may be able to exploit that shared software layer through the website. The article reports that more than 90% of Russian-language websites and almost 70% of websites globally run on PHP.

That scale makes emergency patching difficult. Experts told RBC that tens or hundreds of thousands of Russian websites could remain vulnerable. The risk also extends across government, financial, energy, transport and medical systems, where disruption or unauthorized access could affect essential services.

PHP’s reach is unusually large. The article cites W3Techs data showing that more than 90% of Russian-language websites and almost 70% of the web globally run on PHP. These figures explain why a newly disclosed vulnerability triggered urgent action from governments, companies and cloud providers.

In Russia, the exposure may be especially broad. Tech experts told RBC that tens or hundreds of thousands of Russian websites could remain vulnerable because organizations widely rely on PHP. The affected systems include more than ordinary public pages; the FSB warning also covered government information systems and critical industries.

This scale creates a race between defenders and attackers. Organizations must identify every affected server, install the emergency fix and check for suspicious activity. Until that happens, operators may restrict outside access or suspend websites. The article reports that hacking attempts surged into the millions after disclosure.

A critical software vulnerability can give attackers a path into a vulnerable web application or server. The article does not specify exactly what these PHP flaws permitted, so the general risk is unauthorized access, disruption or compromise of systems running the affected code. That risk is serious when the server supports government or essential services.

The key mechanism is exposure. An internet-connected server can receive hostile requests, giving attackers opportunities to trigger the flaw. If operators restrict external access, those requests cannot reach the vulnerable service from outside. Fully shutting down the server goes further by stopping the affected service altogether while defenders install the fix and investigate.

This is a temporary safeguard, not a replacement for patching. The FSB also ordered emergency updates, antivirus scans and suspicious-activity reporting. The article says hacking attempts surged into the millions after disclosure, so reducing exposure buys organizations time during the most active period.

The FSB directive applied to communication networks and information systems across government agencies. It also covered financial, energy, transportation, medical and other companies. The article groups these systems under critical infrastructure because failures in them can affect services that governments, businesses and the public depend on.

The practical example is a vulnerable web server supporting one of these organizations. Operators were told to apply emergency patches, conduct full antivirus scans and report suspicious activity. If they could not patch quickly, they were told to restrict external access, including shutting down the server. These steps protect systems while repairs are underway.

Communications connect users and institutions. Finance supports payments and economic activity, while energy and transport underpin daily operations and supply chains. Medical systems support healthcare delivery. The article does not detail specific consequences for each sector, but their inclusion shows that the warning focused on services where cyber disruption could have broad effects.

The PHP flaws were reported privately to the language’s developers and kept confidential while a fix was prepared. This coordinated approach gave defenders time to produce and deploy a patch before detailed information became widely available. It aimed to reduce the period when the vulnerability was known but not yet repaired.

The exposure changed after PHP programmers released the fix on Wednesday. Public disclosure told organizations what needed attention, but it also alerted attackers that vulnerable systems might exist. Attackers could then scan for websites and servers that had not yet installed the update. Cloudflare and Amazon reported a surge of hacking attempts.

The article says attempts rose into the millions on Thursday as governments and companies patched systems or suspended websites. This creates a difficult defensive window: disclosure enables repair, but it can also accelerate attacks. Temporary access restrictions help cover that gap while organizations complete patching and checks.

These measures address different parts of the same risk. Patching removes the known PHP weakness. Antivirus scanning looks for malicious software or other signs that an attacker may already have entered. Reporting suspicious activity helps authorities and organizations detect patterns and respond. Restricting external access reduces the number of possible attack paths while repairs continue.

For example, an operator could first limit public access to an exposed server, then install the emergency PHP patch. A full antivirus scan could follow, alongside a review for suspicious activity. If something appears wrong, reporting it can support a wider response. The sequence combines prevention, detection, containment and communication.

The article shows why layered action mattered. Hacking attempts surged into the millions after disclosure, while experts warned that many Russian websites remained vulnerable. No single measure solves the problem: patching is essential, but isolation, scanning and reporting help manage the danger during the emergency.