American Express confirmed its recent service disruptions were due to an internal technical issue, not the PHP vulnerabilities affecting other sites.
Key points
- American Express stated its app and website issues were not caused by a security vulnerability.
- The company attributed the outage to an internal technical problem that has since been resolved.
- Some 911 services in California experienced disruptions linked to fiber optic line vandalism.
American Express experienced service disruptions on its website and mobile application that caused confusion among users. The company clarified that these issues were unrelated to the widespread PHP security vulnerabilities currently impacting the internet.
What happened
American Express customers reported intermittent disruptions to the company’s mobile app and website on Wednesday, according to Gizmodo. These outages led to speculation that the financial services giant might be affected by the so-called Black October cybersecurity crisis involving critical PHP flaws. A spokesperson told Gizmodo via email that the disruptions were not caused by a security vulnerability.
The company described the incident as an internal technical issue that is now resolved, though it did not provide further technical details. Wait times for customer care professionals were longer than usual during the incident. Reports on DownDetector showed the number of users experiencing problems had trickled down to double digits by the time of reporting.
Separately, Verizon reported that 911 service disruptions in Riverside and Santa Barbara counties were caused by vandalism of fiber optic lines in Los Angeles. Engineers are repairing the damage while cooperating with local authorities and the FBI. It remains unclear if a 911 disruption in Oakland is related to the PHP vulnerabilities.
Why it matters
Service outages often trigger immediate suspicion of cyberattacks, especially during periods of widespread vulnerability exploitation. When major platforms go down, users and organizations must distinguish between intentional malicious activity and routine technical failures. Understanding the root cause helps determine the appropriate response, such as checking for data breaches versus simply waiting for service restoration.
The fix
- Verify official status pages for service updates.
- Check if the outage is widespread or isolated.
- Monitor official communications for cause details.
- Avoid assuming a breach without confirmation.
Why it matters
Teams usually monitor status dashboards first to confirm if an outage is global or local. They should check whether the vendor has issued a security advisory or merely a technical incident report. It is important to wait for official confirmation before assuming data was compromised. Users should review their own account activity for unusual changes while services are unstable.
What to do and how to stay safe: American Express
- Check the American Express status page or official social media channels for real-time updates on service availability.
- Review your recent account transactions for any unauthorized activity, even if the outage was not a security breach.
- Wait for official confirmation before assuming your data was exposed during the downtime.
- Contact customer support if you notice discrepancies in your account history after services resume.
Step-by-step guide: What is password policies and how they protect systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was the American Express outage caused by a hacker?
No, American Express stated the disruptions were not caused by a security vulnerability but by an internal technical issue.
Is the 911 outage in California related to the PHP crisis?
Disruptions in Riverside and Santa Barbara counties were caused by fiber optic vandalism; the Oakland situation is unclear.
When did the American Express issues start?
Customers experienced intermittent disruptions to the app and website on Wednesday.
