Adversary Intelligence — 2026-10-26

FSB Orders Russian Critical Infrastructure Websites Patched or Taken Offline Over PHP Vulnerabilities

BLUFMoscow's directive to pull vulnerable sites offline trades cybersecurity risk for service disruption, but it is unlikely that a confirmed exploitation against Russian critical infrastructure surfaces publicly by late November given strong disincentives to disclose.

The FSB's National Coordination Center for Computer Incidents (NKTsKI) sent a directive on October 22 through GosSOPKA telling critical information infrastructure operators to install the patched PHP, run antivirus scans and review logs for intrusion signs 12. RBC obtained the document, and three recipient organizations confirmed its authenticity 12. Where updating is not quick, operators should "consider temporarily restricting external access to vulnerable web servers, up to and including taking them offline" 1. PHP developers released emergency fixes on October 21 for two flaws rated 9.2 of 10 that allow unauthenticated remote code execution 23. SecurityLab.ru reported CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 4. Moscow Times reported that Cloudflare and Amazon recorded millions of exploitation attempts 5. A Garda WAF technical director told RBC that tens or hundreds of thousands of Russian sites may be exposed 2.

Analysis
Moderate confidence rests on consistent reporting of the NKTsKI directive, whose authenticity three recipient organizations confirmed to Meduza, though the other outlets merely relay RBC and no outlet documents a compromise of a Russian target. It is unlikely that a Russian government body or major Russian media outlet reports a confirmed successful exploitation of CVE-2026-109618 or CVE-2026-109619 against a Russian critical infrastructure or government website by November 25. Russian authorities and operators have little incentive to disclose critical infrastructure breaches, so any confirmed incident would surface mainly through leaks, hacktivist claims or independent media. The directive may be a precautionary compliance step rather than evidence of Russian exposure, and successful intrusions may occur but go unreported under state secrecy norms. Operators of legacy portals bear the cost now, since compatibility testing delays patching and the shutdown option shifts outage risk onto service availability. A confirmed compromise would push operators to treat patching as incident response and expand compromise hunting beyond log review, while its absence leaves them on routine patch-or-isolate timelines. NKTsKI follow-up bulletins and hosting-provider notices would be the earliest signs of actual compromise.

6 sources