Denmark has activated its national crisis coordination staff, NOST, after two critical security flaws in the programming language PHP left websites worldwide exposed to attack.
The Ministry for Social Security and Emergency Management confirmed the activation to DR on October 22. The National Operational Staff, known as NOST, is used when an incident requires coordination across several Danish authorities. It is led by the Danish Agency for Social Security, Styrelsen for Samfundssikkerhed.
The confirmation followed reporting by TV 2, which stated on the evening of October 21 that a meeting had been held in the staff. Several websites were temporarily taken offline as a precaution, according to DR. Danish authorities were not aware of any websites that had been hacked because of the flaws.
Three readiness levels, currently at the lowest
NOST has three possible activation levels, which can be raised or lowered based on a concrete assessment until the situation is stable, per the Agency for Social Security. Denmark is currently at level one, called information readiness. At that level the participating authorities do not necessarily meet in person.
Instead, monitoring is tightened and communication lines between the authorities are reinforced. Rigspolitiet, the national police, states on its website that the staff consists of a fixed group of authorities, with others called in depending on the nature of the incident.
What the two PHP flaws do
The two vulnerabilities, registered as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Amazon Web Services reported on October 21 that they are rated 9.2, or critical, under the CVSS v4.0 scale. The PHP project released emergency fixes for versions 8.2 through 8.5 and urged users to update immediately.
Amazon also said it had seen attempts to exploit the vulnerabilities both before and after they were made public. As reported by ABC News, the company registered those attempts on October 21. OpenAI, which found the flaws, called them one of the most significant vulnerabilities in recent times and says PHP is used to run 70 percent of all websites.
OpenAI stated that it coordinated with the PHP maintainers, the security firm Wiz and Cloudflare to prepare fixes before public disclosure. Jeppe Engell, cybersecurity expert at the business organization Dansk Industri, told DR on October 21 that he could not think of anything as serious as this. Dansk Industri told its members that updates had to happen now, not tomorrow.
Minister calls updates decisive
Emergency management minister Lisbeth Bech-Nielsen of the Socialist People’s Party described the incident as serious and global, affecting very large numbers of people. She said the door is standing wide open.
The minister noted that the discovery of the flaws is in one sense positive, but that potential attackers now also know about them. She therefore urged companies using PHP to install the critical updates as quickly as possible.
What the PHP flaw means for internationals running businesses or websites in Denmark
NOST is Denmark’s standing mechanism for coordinating authorities during a crisis, and it is not limited to cyber incidents. Its activation at level one means heightened monitoring and information sharing rather than operational emergency measures. The responsibility for patching systems sits with the companies and organizations that run them.
For foreign residents who run a business, a webshop or a freelance website in Denmark, the sourced instruction from both the emergency management minister and Dansk Industri is the same. Systems using PHP versions 8.2 through 8.5 need the emergency fixes released by the PHP project, according to Amazon Web Services. DR reports that no Danish site is known to have been hacked, and the live situation is being followed in the broadcaster’s liveblog.
