Summary

  • RIPE NCC took four public hostnames offline as a precaution after two critical PHP vulnerabilities were disclosed; its status log records full restoration 44 hours 55 minutes later.
  • The public record gives shutdown, patching and reopening times, but not each host’s PHP version, applied fix or validation result.

A shutdown has a clock. RIPE NCC’s started at 17:37 CEST on 21 October, when its status page said four public destinations had been taken offline as a precaution: academy.ripe.net, elearning-2.ripe.net, www.nro.net and aso.icann.org/aso-ac/. Full restoration came at 14:32 CEST on 23 October. That is 44 hours and 55 minutes.

The decision followed two critical vulnerabilities in PHP. PHP’s official advisory says CVE-2026-109618 and CVE-2026-109619 could permit unauthenticated remote code execution in affected setups. The PHP project released fixed versions across four supported branches on 21 October. RIPE NCC’s own notice described two critical PHP vulnerabilities and said the sites were offline while it tested and applied patches. It did not name the CVEs or the PHP builds running on those hosts.

The status log shows a staged return, not a single green light. At 13:27 CEST on 22 October, RIPE NCC said upstream patches had been released and teams were updating services as dependencies became available. At 09:22 the next morning, the Academy and its separate e-learning hostname were back. At 14:32, the status page marked all services online.

RIPE NCC’s 28 October notice says testing was complete and security updates had been applied on 23 October. It reports no indication that the vulnerabilities were exploited within its systems. That is a clear statement about what the organization found; the public record does not attach it to a host-by-host test report.

The distinction matters because these were not disposable campaign pages. The Academy and e-learning host deliver training; the NRO and ASO pages serve the institutions coordinating the regional registries and their role in ICANN’s Address Supporting Organization. A precautionary shutdown removed useful public access while staff contained risk. The log gives readers the duration and sequence, so the cost is visible.

What remains invisible is the deployment map: which PHP version each hostname ran, which fixed build reached it, and what check returned it to service. RIPE NCC’s notices do not publish those details. A per-host patch and validation table would let members verify why each site returned when it did.

The incident record supports a narrow conclusion: four public destinations were taken offline, patched and restored over roughly 45 hours, with no exploitation found by RIPE NCC. The next useful record is the one that joins each hostname to its fixed runtime and post-update check.

Sources