RIPE NCC closes four-site PHP shutdown

RIPE reopened four doors. Its status page kept two clocks

Why it matters

The Academy sites returned in the morning; the all-clear for the four-site PHP shutdown came five hours and ten minutes later.

Daniel Kade23 October 2026 at 18:29 UTCReading Time 2 minLast update: 23 October 2026

Les sites de formation sont revenus avant l’annonce générale de RIPE NCC.

Summary

RIPE NCC reported its Academy and e-learning 2 sites available at 09:22 CEST on 23 October; it marked the four-site incident resolved at 14:32.
The record shows a staged public all-clear after a precautionary PHP-vulnerability shutdown, with training and institutional reference pages on different checkpoints.

A green light arrived in two deliveries. At 09:22 CEST on 23 October, RIPE NCC’s incident log said the Academy and e-learning 2 websites were available. At 14:32, the operator closed the incident with a plain sentence: “All services are back online.” Five hours and ten minutes separate those public statements. The log does not timestamp the individual return of the NRO and ASO sites.

The sites had been taken offline on 21 October after PHP vulnerabilities were discovered. A 22 October update said upstream patches had been released and teams were updating services as dependencies became available. The sequence now has an ending rather than an indefinitely open investigation: two learning sites named as available first, then a complete all-clear.

That split matters to anyone who went looking for a specific door. RIPE NCC Academy hosts self-paced courses and certification paths. The NRO and ASO Address Council sites serve as public windows into number-resource coordination and institutional work. A learner checking a course and an operator looking for an official governance reference had different reasons to refresh the page. “The Internet is up” would have been a useless answer to both.

RIPE NCC’s status entry names the four withdrawn URLs and dates the two return notices. That is the useful receipt. The patch description belongs to the operator; the status page is a record of declared availability, not a security-audit report. A later technical account could add exactly when each institutional site returned and what checks cleared it. For now, the doors are open and the timetable is public. An institution’s public face is part of its infrastructure, even when the status board files it under “non-critical.”