AI-Native Engineering

“Progressive Shutdown”: How Spanish Regional Governments Responded to the 2026 PHP Alert

CCN-CERT told Spanish bodies to switch off non-essential exposed PHP services until patched: what Castilla-La Mancha and Andalusia did

Published 2026-10-25Updated 2026-10-255 min read

PHPpublic sectorSpainCCN-CERTpatchingincident response

This article is educational and does not replace a formal smart contract audit, legal advice, financial advice, or protocol-specific security review.

On 21 October 2026, Spain's national CERT for the public sector, CCN-CERT, told organisations to update every PHP application immediately and, until they could, to switch off exposed services that were not indispensable. Two days later the regional government of Castilla-La Mancha announced an “apagado progresivo y temporal” (a progressive, temporary shutdown) of the affected services. In Andalusia, the regional employment service suspended access to saempleo.es and other corporate pages for a morning as a preventive measure.

Neither body reported an attack on its own systems. What they show is the gap between the day a fix exists and the day an organisation can apply and check it across many services. For organisations running older PHP branches, or that cannot update on patch day, a staged shutdown with a staged restore is a controlled way to apply what CCN-CERT itself recommended: switch off what is not indispensable until it is updated.

Scope: this article relies only on what CCN-CERT, the Junta de Castilla-La Mancha and the Servicio Andaluz de Empleo published between 21 and 23 October 2026. Spanish quotes are given in the original with an English translation. “Shutdown” means a precautionary step, in the institutions' own words. None of these sources reports a confirmed compromise or the share of servers that went offline.

Daylit IT desk; a hand powers off one of several generic monitors (blank blue browser chrome); small Spanish flag on a cabinet; navy walls and wood. — Conceptual illustration.

What happened, in dates

21 October 2026: the PHP project publishes 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can allow unauthenticated remote code execution. It notes that PHP 8.1 and older no longer receive updates.
21 October: CCN-CERT issues alert AL 11/26, rated “CRÍTICO” (critical), recommending an immediate update of all PHP-based applications.
22 October: the Servicio Andaluz de Empleo (SAE) posts a notice that access to saempleo.es and other corporate pages has been suspended temporarily. The notice is later updated to say access has been restored.
23 October: the Junta de Castilla-La Mancha says its Digital Transformation Agency is shutting down the affected services progressively and temporarily, with no set date for full recovery.

What CCN-CERT asked for

The alert opens with two sentences: “El CCN-CERT recomienda a todas las organizaciones actualizar inmediatamente todas las aplicaciones basadas en PHP. Hasta que se realice la actualización, los administradores deben apagar los servicios expuestos cuyo uso no sea indispensable.” (CCN-CERT recommends that all organisations immediately update all PHP-based applications. Until the update is done, administrators should switch off exposed services whose use is not indispensable.)

Its recommendations add a softer variant for the same case: when patches cannot be applied immediately, organisations “deberían aislar las aplicaciones conectadas a Internet cuyo uso no sea indispensable hasta que esté disponible la solución” (should isolate Internet-facing applications whose use is not indispensable until the fix is available). The first step it lists is to identify all PHP-based applications.

Two details matter for operators. The instruction is selective: it covers exposed services that are not indispensable, so someone has to decide which ones are. And the alert, as published, lists the identifiers as “CVE-2026-109618 y CVE-2026-109618”, the same number twice. The PHP project's advisory lists two, CVE-2026-109618 and CVE-2026-109619, so teams matching scanners or tickets against the alert should check the identifiers at the source.

Castilla-La Mancha: a progressive, temporary shutdown

The regional government's note of 23 October says that the Agencia de Transformación Digital “está procediendo al apagado progresivo y temporal de los servicios afectados para reestablecerlos lo antes posible” (is proceeding with the progressive and temporary shutdown of the affected services in order to restore them as soon as possible). It frames the step as a contingency measure following the CCN-CERT recommendation, taken to avoid exposure while the affected applications are updated.

The note also describes how services will come back: “El restablecimiento de los sistemas se llevará a cabo de forma progresiva, una vez realizadas las comprobaciones necesarias” (systems will be restored progressively, once the necessary checks have been carried out). It adds that “no se ha determinado un plazo concreto para la recuperación completa” (no specific timeframe has been set for full recovery).

It is explicit about scope: “El problema no es específico de la Junta de Comunidades, sino que puede afectar tanto a organismos públicos como a entidades privadas a nivel mundial” (the problem is not specific to the Junta de Comunidades, but can affect both public bodies and private entities worldwide). The agency also recommends that the private sector take the same measures. The note does not say which systems or PHP versions the Junta runs.

Andalusia: the employment portal for a morning

The SAE notice, dated 22 October, is titled “SAE informa: el acceso a la web saempleo.es y otras páginas corporativas se ha suspendido temporalmente” (SAE informs: access to the saempleo.es website and other corporate pages has been temporarily suspended). It describes the step as “medidas preventivas en respuesta al aviso de incidencias sobre los sistemas php detectados a nivel mundial” (preventive measures in response to the notice of issues in PHP systems detected worldwide).

Two features make it a useful pattern. The suspension was partial: the notice says that private areas for people and companies, appointments and the Gescontrat@ service stayed reachable through direct links, and individuals could also use the app and employment points. And it was short: the updated notice says access was suspended during the morning and that access to online services through saempleo.es has been restored.

What “progressive” says about patch capacity

A progressive shutdown is an admission, in operational terms, that an organisation cannot update everything at once. That is not a failing of one administration. A regional government runs many portals and applications, often built by different suppliers on different stacks, and each one needs its PHP runtime identified, updated, tested and checked before it goes back online.

Supported branches add a second constraint. The fixed releases cover PHP 8.2 to 8.5. A service still on 8.1 or older gets no regular release: the PHP project says those branches no longer receive updates and offers only minimal source backports for 7.4, 8.0 and 8.1, for teams that build from source. Otherwise it needs a vendor with backported fixes or a migration to a supported branch. Published platform policies show how regional IT tracks this. The Galician agency AMTEGA's technology platform document (version 02.12, June 2026) classes PHP 8.1 and earlier as “Obsoleto”, lists 8.2 as the current corporate version with security support to December 2026, and puts 8.5 on its roadmap for Q2–Q3 2026. That document predates this alert and says nothing about the Xunta's response; we found no source on whether Galicia switched services off.

The cost falls on citizens who cannot reach a service. The SAE case shows how to reduce it: keep the transactional paths people need reachable by other routes, say so in the notice, and restore the public site as soon as the check is done.

A runbook for a controlled shutdown

Keep an inventory of every PHP runtime, including PHP inside products from suppliers, with its branch and owner. CCN-CERT's first step was to identify all PHP-based applications.
Classify services in advance as indispensable or not, so the CCN-CERT test can be applied in minutes, not debated during an alert.
For services that must stay up, plan isolation from the Internet, the alternative CCN-CERT gives, before you need it.
Prepare the public notice template: what is suspended, why, which alternative channels work, and where updates will appear. The SAE notice is a compact model.
Shut down in a defined order and log each service with the time it went offline.
Before restoring, check the PHP version the live service is actually running. Restore in stages, as the Castilla-La Mancha note describes, and log the time each service comes back.
Afterwards, compare the two timestamps per service. That gap is your real patch pace.

What this article does not claim

No attack. None of the three sources says that the Junta de Castilla-La Mancha, the SAE or any other body named was attacked or compromised.
No percentage. No official source gives the share of public servers or sites that went offline in Spain, so none is given here.
No stack details. The Castilla-La Mancha note and the SAE notice do not say which PHP versions those bodies run.
No judgment on the bodies named. Switching off non-essential exposed services was the step CCN-CERT recommended.

Questions to ask this week

Which of our public services run PHP, including inside products we buy, and on which branch?
Which of them have we classed as indispensable, and who signed that off?
If we had to switch them off tomorrow, what would the notice to users say, and which alternative channels would work?
How would we prove, before restoring, that each service runs a fixed version?

Closing

CCN-CERT's alert gave Spanish organisations two options: update now, or switch off what is not indispensable until you can. Castilla-La Mancha and the SAE took the second, in stages and in public. The useful question is how many hours your own organisation would need to make the first one possible.

If you want to discuss how patch pace and controlled shutdowns work in your own systems, the contact page is open. In the message, mention this article and the system you have in mind, without credentials or confidential operational details.