Hackers are knocking. 29 Portuguese public bodies are running outdated code

One Portuguese public website appears to be running software from 2006. It’s Friday, 23 October. Nineteen degrees. Air quality: 25 to 40 (Good). Here’s what you need to know.

🗞️ TOP STORY

PORTUGUESE PUBLIC BODIES ARE STILL ON OUTDATED SOFTWARE AFTER A GLOBAL HACKING ALERT

A day after fixes for a major web security flaw were released, 29 Portuguese public bodies, including councils and hospitals, were still running website software that no longer gets security updates. The problem is in PHP, the programming language behind a large share of the internet, including WordPress, which alone runs around 40% of all websites. Two flaws, each rated 9.2 out of 10 for severity, could let a hacker run their own code on a vulnerable server without logging in. When they came to light on Wednesday, organisations around the world took websites offline rather than risk it.

Among the sites pulled as a precaution were parts of Wikipedia, the Dutch digital ID system and parliament website, the Paris police portal, Edinburgh’s city council and Japan’s tax agency. Most are back online now, and there are still no confirmed successful attacks.

The Portuguese figures come from Cybers3C, a cybersecurity consultancy, which checked 223 websites belonging to public bodies. One state body’s site appeared to be running a version of PHP from 2006. The organisations weren’t named, and old software isn’t the same as having been hacked. Some councils and services moved quickly to update, but checks on Wednesday evening, after the fixes came out, and again on Thursday still found 29 on unsupported versions. Separately, a public scan by the civic group Cidadãos pela Cibersegurança found at least 23 council websites and seven government sites running PHP. The group says the real number could run into the thousands.

Hackers aren’t waiting. Matthew Prince, the chief executive of Cloudflare, which protects websites from attacks, has said they’ve already made millions of attempts to exploit the flaws. PHP’s developers say the only full fix is to update, and sites on older versions may need to move to a supported release, not just install a patch.

For most readers, there’s nothing to install: PHP runs on the servers behind websites, not on your phone or laptop, and there’s no sign so far of anyone’s personal data being exposed. If you run a website yourself, including a WordPress site for a business or a blog, check with your host that PHP has been updated. Sites on version 8.1 or older will need an upgrade or a fix from their supplier.

Bottom line: The fix exists, but it only works once each site’s owner installs it, and some Portuguese public bodies are running software so old it may need replacing.

⚡ QUICK HITS

Rossio’s housing protesters spent Wednesday night sleeping in the open after voting to take their tents down. After an assembly that ran for more than three hours, protesters put tents back up in the square. Then, at around 12:45am, 338 of them voted to take them down and sleep without them, and the PSP, the Public Security Police, let them stay as long as there were no tents and no noise. When tents reappeared on Thursday morning, officers gave the group 10 minutes to remove them, and they did. The movement is holding an assembly in Rossio every evening at 7pm, and the 55 people detained on Tuesday are due in court next Tuesday, 27 October.

Planes leaving Lisbon airport will fly further from homes north of the city by the end of the year. Portugal’s civil aviation authority has approved a small westward shift in take-off routes, proposed by the air navigation service. It should mean about 35,000 fewer residents in Loures and Vila Franca de Xira living under the noise. The change follows complaints about a 2024 reorganisation that sent departures over land at Alverca instead of the Tagus estuary. More than 200,000 people in Lisbon, Loures, Vila Franca de Xira and Amadora are still affected, and a €10 million state programme will pay for sound insulation in the worst-hit homes in 2026 and 2027.

Homes in Lisbon are selling more slowly than in most of Portugal. A study by the property portal idealista found that 12% of homes listed in Portugal in the third quarter sold within a week, but only 7% in Lisbon, where 42% took between three months and a year to find a buyer. Ponta Delgada was quickest, with 16% selling inside seven days, followed by Aveiro and Porto. Across Portugal, seven in ten homes took more than a month to sell, and Beja was slowest, at 4%.

Portugal has come fifth in a ranking of the best countries to live in. The Nomad Lifestyle Index, produced by the consultancy Nomad Capitalist, scored 63 countries on safety, ease of getting residency, quality of life, tax and climate. Portugal scored 70.09 out of 100, behind Monaco, Andorra, the United Arab Emirates and Malta, but ahead of Switzerland (7th), Spain (42nd) and the UK (47th). Its weakest area was climate, because of growing exposure to extreme weather.

The next wave of millionaires will be people who figured out how to make AI work for them.

The window to get ahead is still open. But not for long.

Here are 200+ proven ways to make money with AI in 2026.

Sign up for Superhuman AI, the free daily newsletter read by 1M+ professionals, and get instant access to all 200+ ways to profit from AI this year.

Claim your free list

A quick note: today’s ad comes from one of our network partners, Superhuman AI. Partnerships like this one are what keep The Lisbon Letter free to read every morning, and we thank them for it.

🍽️ SPOT OF THE DAY

CABRA CEGA (RESTELO)

Cabra Cega is Portuguese for blind man’s buff, and that’s roughly how dinner works. You pick one of two tasting menus, the dishes change, and the menu gives almost nothing away. To give you an idea, one course this summer was listed only as “something from the earth, dates and parsnip”, and turned out to be black angus seared in seconds with a fermented date sauce. A lot of the cooking happens over fire, which one of the two chefs learned at Fogo in Lisbon and Firedoor in Sydney. Mesa Marcada, the Portuguese food site, called it a surprisingly solid kitchen that offers good value for this kind of cooking.

Pé de Cabra, named after the crowbar the chefs used most while renovating the place themselves, is seven courses for €50, and Cabra Cega adds three more for €70. The kitchen likes to push it: one summer dessert paired crystallised cabbage with shiitake ice cream and caramelised white chocolate. The wine list says outright that it was put together by people who cook and drink, not by sommeliers, with glasses from €9 and bottles from €28.

The room feels lived in. The old green oval shopfront has been kept. Inside there are dark green tiles, tables cut from tree trunks, and a shelf of the chefs’ odds and ends, from jars of fermented lemon to a skateboard signed by an old kitchen team in San Francisco. The name has caused some confusion: it sits next door to a sex shop, and people have rung up asking whether it does massages.

Worth knowing before you go: it’s dinner only, from Tuesday to Saturday, and closed on Sunday and Monday. There’s a big table by the door that works for groups. Book ahead.

→ Find them here ←

Insider tip: ask for the stools at the U-shaped counter, which face straight into the open kitchen. It’s the best view in the room.

📅 WHAT’S ON

See you tomorrow morning.

Reach Lisbon’s English-speaking community, every morning. Advertise.