Finland took several government websites offline on October 21 after two serious security flaws were found in PHP, a software language used to run websites. The Government ICT Center, known as Valtori, started restricting the incoming internet traffic at 12.45 pm local time to prevent any kind of cyberattack. Reportedly, the National Land Survey of Finland was among the affected services.
Agencies reported no evidence that any scammer used these vulnerabilities for a cyberattack, but the shutdown was meant to protect the sites once the news became public. Valtori stressed that the shutdowns were preventive measures, not a response to a confirmed cyberattack or data breach.
The two flaws received a severity score of 9.2 out of 10 under the CVSS 4.0 rating system. They could allow attackers to run harmful code on affected systems without logging in. However, a software update to patch both vulnerabilities was scheduled at 5 pm Finnish time on Wednesday. The agency said it would install the patches across all PHP applications and restore public access after the security check.
Also Read: How Cybersecurity Startups are Tackling AI-Generated Phishing Attacks
Website Outages Could Disrupt Key Public Services
The shutdown shows how much people depend on government websites for daily tasks. The National Land Survey helps people find land and property records. Similarly, other government websites provide information on online forms and services that people generally need for personal or professional work. Therefore, when these sites go down, the situation instantly turns into a mess, with hundreds of people losing access to important records, filing forms, or getting important details.
Finland's PHP security scare highlights the need for quick action when software flaws put public systems at risk. The National Cyber Security Center has prompted the website administrators to install the update as soon as it comes out and resume public access after a security check. Valtori also said it will keep monitoring the affected websites once the administrators finish their part of the security check.