The digital tools that allow SEPTA riders to track buses and trains in real time were back online Thursday morning after being disabled Wednesday as a cybersecurity precaution.
Federal cybersecurity officials had recommended that organizations using PHP, a programming language, immediately install security updates or take affected services offline until they could be secured. The recommendation prompted SEPTA to disable its tools.
Around 7 a.m. Thursday, the systemwide alerts on SEPTA’s website were back online after officials successfully installed security patches.
System Wide: SEPTA real-time tools are back up again running. Thank you for your patience as we proactively installed security patches.— SEPTA (@SEPTA) October 22, 2026
During the outage, riders could still access real-time information through the free Google Maps app and the subscription-based Transit app, which officials said had agreed to temporarily remove its paywall to help SEPTA riders during the outage.
On Wednesday, the National Security Agency said it found security flaws that created an environment easy to exploit and could allow hackers to gain access to systems.
The PHP code is used on nearly 70% of websites, including SEPTA and its real-time tools for tracking trains and buses.
“With the advent of AI doing a lot of the detection of vulnerabilities, it’s going to get harder and harder for us to stay on top of these things like we used to be able to. We’re almost going to have to change the way that we address these patches and provide timely updates because the scale and the speed at which these vulnerabilities are coming out is really not something we’ve seen before,” Matt Barnett, a cybersecurity expert, said.

The digital tools that allow SEPTA riders to track buses and trains in real time went offline in response to federal cybersecurity recommendations, officials said. NBC10’s Lili Zheng has more.
The digital tools that allow SEPTA riders to track buses and trains in real time were back online Thursday morning after being disabled Wednesday as a cybersecurity precaution.
Federal cybersecurity officials had recommended that organizations using PHP, a programming language, immediately install security updates or take affected services offline until they could be secured. The recommendation prompted SEPTA to disable its tools.
Around 7 a.m. Thursday, the systemwide alerts on SEPTA's website were back online after officials successfully installed security patches.
System Wide: SEPTA real-time tools are back up again running. Thank you for your patience as we proactively installed security patches.
— SEPTA (@SEPTA) October 22, 2026
During the outage, riders could still access real-time information through the free Google Maps app and the subscription-based Transit app, which officials said had agreed to temporarily remove its paywall to help SEPTA riders during the outage.
On Wednesday, the National Security Agency said it found security flaws that created an environment easy to exploit and could allow hackers to gain access to systems.
The PHP code is used on nearly 70% of websites, including SEPTA and its real-time tools for tracking trains and buses.
"With the advent of AI doing a lot of the detection of vulnerabilities, it's going to get harder and harder for us to stay on top of these things like we used to be able to. We're almost going to have to change the way that we address these patches and provide timely updates because the scale and the speed at which these vulnerabilities are coming out is really not something we've seen before," Matt Barnett, a cybersecurity expert, said.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | Yle: Финляндия отключила сайты государственных ведомств из-за уязвимости PHP | 0 | 10.63 | 23-10-2026 |
| 2 | Центр при ФСБ отреагировал на уязвимости PHP, найденные ИИ | 0 | 8.4 | 23-10-2026 |
| 3 | Cyber agency warns websites may go dark as PHP prepares critical fix | 0 | 7.71 | 21-10-2026 |
| 4 | Philly school district denies congressional report's antisemitism claims | 0 | 5.93 | 22-10-2026 |
| 5 | Бундестаг предупредил о новом уровне киберугроз из-за уязвимости языка PHP | 0 | 10.21 | 22-10-2026 |
| 6 | PHP-Sicherheitslücke: IT-Experten fordern umfassende Maßnahmen über Updates hinaus | 0 | 14.49 | 23-10-2026 |
| 7 | Уязвимость PHP вызвала отключение сайтов по всему миру | -1 | 8.18 | 22-10-2026 |
| 8 | Госсайты отключаются по всему миру из-за «дыры» в PHP. Wikipedia выключила часть систем | 0 | 12.69 | 22-10-2026 |
| 9 | RBB: Ряд государственных сайтов в Германии отключили из-за угрозы кибератак | 0 | 8.42 | 21-10-2026 |