diff --git a/src/content/news/2026/critical-php-vulnerabilities-affect-elixir-norway-services/index.mdx b/src/content/news/2026/critical-php-vulnerabilities-affect-elixir-norway-services/index.mdx
new file mode 100644
index 00000000..0ebfdf19
--- /dev/null
+++ b/src/content/news/2026/critical-php-vulnerabilities-affect-elixir-norway-services/index.mdx
@@ -0,0 +1,26 @@
+---
+layout: "../../../../layouts/page.astro"
+variant: "article"
+title: "Critical PHP vulnerabilities affect ELIXIR Norway services"
+date: "Oct 23, 2026"
+summary: "Two critical vulnerabilities in PHP, found with the help of AI, have taken down websites across the Norwegian public sector. Some ELIXIR Norway services will be affected while we apply security updates."
+tags:
+  - "infrastructure"
+  - "services"
+---
+
+On Wednesday 21 October, the Norwegian National Security Authority (NSM) issued a warning about two critical vulnerabilities in PHP. Both allow an unauthenticated actor to run arbitrary code over the internet, which could have given an attacker full control of a server.
+
+PHP is the programming language behind large parts of the web, including WordPress and Drupal. Around 70 percent of the world's websites use PHP.
+
+The Norwegian Directorate for Digitalisation took down its pages after the warning, and OsloMet's website also went down. So did Feide, the common login solution for the education and research sector.
+
+Some of our services will be affected while we apply the security updates. We are patching all systems that run PHP as quickly as possible, prioritising our public-facing services. If you cannot reach a service, or notice unexpected behaviour, please let us know at [support@elixir.no](mailto:support@elixir.no).
+
+The vulnerabilities have been present in the PHP code base for more than ten years. They were found with the help of AI language models, and security researchers report that they would have been very difficult for a human to discover. Security updates were released on Wednesday afternoon, and NSM recommends that all system owners install them as soon as possible. Websites running PHP 8.1 or older are particularly exposed.
+
+Attempts to exploit the vulnerabilities are already under way, so the window to patch is short. We are following the situation closely together with our host institutions and the wider Norwegian research infrastructure community.
+
+We will update this article as the situation develops.
+
+Source: [Shifter (in Norwegian)](https://www.shifter.no/nyheter/stengte-ned-norske-nettsider-etter-ai-oppdaget-sikkerhetshull/479995)