Russia and Ukraine Finally Find Common Ground: Emergency Apps That Anyone Can Send Alerts From

KYIV and MOSCOW — For the first time in years, officials in Kyiv and Moscow spent the same Sunday evening doing the same thing: posting statements explaining that their own emergency app had not meant any of it.

Ukraine’s Air Force said its Air Alert app had been compromised and used to send false warnings of nuclear and chemical threats to Kyiv and other areas, along with alerts about street fighting. The Air Force moved quickly to correct the record. “There is no radiation threat! Stay calm, follow our messages on our channel,” it said.

About two hours later, Russia’s Ministry for Emergency Situations reported that its own mobile app had suffered “a massive cyberattack, allowing attackers to send fake information to the public.”

It was not clear whether the two attacks were connected. Neither government immediately said, and neither immediately thanked the other for the company.

Security experts said the incidents exposed a weakness common to emergency apps everywhere: the button that sends an alert to millions of phones works exactly as well for the wrong person as for the right one.

“An emergency alert system has one job, which is to be believed,” said Gail Odermatt, a cybersecurity consultant who has spent 20 years asking clients whether they really need a button that does that. “The moment someone else can press the button, the system has two jobs, and it is only qualified for one.”

Odermatt said the standard fix is unglamorous. It involves requiring more than one person to approve a mass alert, keeping the sending system off the open internet, and testing both regularly. “None of that is exciting,” she said. “That is how you know it works.”

App developers contacted Monday stressed that most push notifications remain safe. A spokesperson for a regional pizza chain confirmed that its “Your order is on the way” alert had not been tampered with and remained, as always, roughly accurate.

The attacks came as a local ceasefire around Oleshky, in Ukraine’s Kherson region, expired at midnight Moscow time. The pause had been the longest in the fighting since the 2022 invasion and had allowed aid deliveries and civilian evacuations. Ukraine’s General Staff said Russia had used the time to reinforce its positions.

Both governments urged residents to rely on official channels for warnings. Asked which official channels, given the week, officials in both capitals pointed to their official channels.

At press time, a civil defense siren in Finland had been asked for comment and responded only by remaining a siren on a pole, which experts noted is very difficult to hack from a phone.