Two serious security holes in one of the world's most widespread programming languages - PHP - have made websites worldwide vulnerable to hacker attacks. Therefore, several websites were temporarily closed yesterday as a security measure.
At the same time, companies using the system are urged from several sides to get it updated, so as not to leave the door open for unauthorized persons.
And as a result of the global security breach, the National Operative Staff (NOST) has now been activated in Denmark.
This is confirmed by the Ministry of Societal Security and Emergency Management to DR, after TV2 ( https://nyheder.tv2.dk/live/tech/2026-10-07-sikkerhedshul-lukker-hjemmesider-over-hele-verden?entry=807a1be1-f740-4223-82e4-06e3861fd0b4 ) last night reported that a meeting had been held in the staff.
------------------------------
Is at the lowest preparedness level
------------------------------
NOST - which is described as the state's highest operational forum for major incidents and crises ( https://samsik.dk/krisestyring/nost/ ) - convenes when a situation arises that requires coordination and cooperation across authorities.
The staff is led by the Danish Emergency Management Agency and also consists of a number of authorities, while others can be called in as needed depending on the nature of the incident, writes the National Police on its website ( https://politi.dk/om-politiet/samarbejde/den-nationale-operative-stab-nost ).
------------------------------------------------------
It has previously caused the crisis staff to convene
------------------------------------------------------
On its website, the Danish Emergency Management Agency has compiled examples of events where NOST has previously been activated. They look like this:
*
March 2026: Parliamentary election
*
February 2026: Snow and frost
*
January 2026: Snow and frost
*
November 2025: Municipal and regional council elections
*
September 2025: Drone activity over airports and military installations
*
July 2025: DMI warning of very dangerous weather
*
November 2024: Major mobile network outage
*
January 2024: Landslide of contaminated soil at Ølst
*
September 2022: Gas leaks on Nord Stream near Bornholm
Source: Danish Emergency Management Agency ( https://samsik.dk/krisestyring/nost/ )
NOST can be activated for a number of different incidents, and when that happens, there are three possible activation levels.
These can be raised or lowered "based on a concrete assessment" and "until the situation is stabilized", it appears on the Danish Emergency Management Agency's website ( https://samsik.dk/krisestyring/nost/ ).
In the current situation, the staff is at the lowest level, which is called information preparedness.
At level 1, the actors do not necessarily meet physically, but there is heightened monitoring, and communication lines across authorities are tightened.
--------------------------
NOST's three activation levels
--------------------------
*
Level 1 - Information Preparedness: This activation level is used when there is a need for heightened monitoring and briefing of managers and key personnel, but where the staff is not immediately convened physically.
*
Level 2 - Staff Preparedness: This activation level is used when a narrow circle of managers and key personnel should be present for information and knowledge sharing as well as immediate discussion and coordination of tasks.
*
Level 3 - Operations Preparedness: This activation level is used when there is a need for a fully established crisis management organization to handle crisis management relevant tasks and functions for a shorter or longer period.
Source: Danish Emergency Management Agency ( https://samsik.dk/krisestyring/nost/ )
-------------------------------------------------------
'One of the most significant vulnerabilities in recent times'
-------------------------------------------------------
We are not aware of any websites that have been hacked as a result of the error.
But this is a serious situation. This was emphasized from several sides on Wednesday when the security breach became publicly known.
For example, OpenAI, which is behind ChatGPT, called the security breach "one of the most significant vulnerabilities in recent times". According to the American company, PHP is used in the operation of 70 percent of all websites.
At the same time, the security risk has been assessed at 9.2 out of 10 on the so-called CVSS score (Common Vulnerability Scoring System) ( https://cert.europa.eu/publications/security-advisories/2026-018/ ), which is an international scale for measuring the severity of security vulnerabilities in IT systems.
Also, the Confederation of Danish Industry's cybersecurity expert, Jeppe Engell, said in an interview with DR yesterday that he could not "think of anything as serious as this".
You can hear him talk about the security breach here:
--------------------------------------------------------
Emergency Management Minister: Crucial to get your system updated
--------------------------------------------------------
Also, Emergency Management Minister Lisbeth Bech-Nielsen (SF) emphasized the seriousness yesterday.
- It is serious in the sense that it is a global incident that affects very, very many people. The door is wide open, she said.
And therefore the minister urged companies that use PHP to act as quickly as possible. Because in a way it is positive that the vulnerabilities have been found, but since it is now public knowledge, those who might want to exploit the vulnerabilities also know about it, she said.
- Therefore, it is crucial that you get critical updates in your system if you have what is called PHP.
And a number of interest organizations and companies that provide IT infrastructure have thus issued the same call as the emergency management minister.
Last night, Amazon Web Services, which is a division of Amazon that provides technical infrastructure to websites and companies worldwide, for example announced that it has seen attempts to exploit the vulnerabilities - both before and after they were publicly reported. And from there, there is a call to immediately update to the fixed versions of PHP.
The Confederation of Danish Industry yesterday issued a similar call to its members. Updates must happen "NOW - not tomorrow", it said.
You can follow the situation continuously in our liveblog here ( https://www.dr.dk/nyheder/indland/di-advarer-om-alvorlige-huller-paa-hjemmesider ).
Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.