RIPE sites restored on 23 October; security statement followed

RIPE’s Four Sites Were Back on Friday. The Security Statement Came Wednesday.

Why it matters

The status page reopened the doors on 23 October; five days later RIPE NCC said it had tested and patched the sites and found no sign of exploitation in its systems.

Theo March29 October 2026Reading Time 2 minLast update: 29 October 2026

Four public sites returned on 23 October; RIPE NCC’s security statement followed on 28 October.

Summary

RIPE NCC’s incident record says Academy and e-learning sites were available by 09:22 CEST on 23 October and all four affected sites were back online at 14:32.
Its 28 October announcement says testing and security updates were completed on 23 October, with no indication that the two critical PHP vulnerabilities were exploited within RIPE NCC systems.

The doors were open before the letter arrived. RIPE NCC’s incident log marked its Academy and second e-learning site available at 09:22 CEST on 23 October, then declared all affected services back online at 14:32. Its formal announcement appeared on 28 October. The five-day interval was between two public notices, not between a fix and a functioning website.

On 21 October, after two critical PHP vulnerabilities were found, the registry had taken down four specific addresses as a precaution: the two learning sites, www.nro.net and the ASO AC site. The raw status record shows an intermediate 22 October update: upstream patches had been released, and teams were updating services as dependencies became available. The 23 October entry closed the incident. No hour-by-hour availability record for each individual site is published there.

The later statement adds the security conclusion missing from a green status lamp. RIPE NCC says it completed testing and applied security updates on 23 October, and found no indication of exploitation within its systems. It gives no testing method or system-by-system findings. That wording is a bounded institutional finding; the four-site service record and the security claim answer different questions.

The earlier Theo March report followed the decision to shut sites while RIPE Database, RPKI, RIPE NCC Access and the LIR Portal remained separately operational. The new fact is the completed return and the institution’s account of what it checked. A member using the Academy needed to know when access returned. A member assessing the incident needed the later statement about patching and evidence. One status badge cannot do both jobs.