Contents
Last updated: 22 October 2026. This article reflects information published up to the evening of 21 October 2026. Situations like this change quickly, so check the NCSC for current advice.
THE HAGUE โ Two critical PHP vulnerabilities led government bodies, hospitals, media outlets and other organisations in the Netherlands and several other European countries to take websites offline as a precaution on Wednesday 21 October 2026. In the Netherlands the affected services included Overheid.nl, MijnOverheid.nl and DigiD. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can allow remote code execution without logging in. PHP released security updates the same afternoon, and many sites returned within hours.
At a glance (21 October 2026)
- Flaws: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 in PHP’s pre-announcement of 20 October.
- Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October.
- Dutch sites offline as a precaution: Overheid.nl, MijnOverheid.nl, DigiD, the NCSC and many others.
- Exploitation: the NCSC and CISA had not seen active exploitation; Cloudflare reported attack traffic against its customers.
1. What happened, hour by hour
All times below are Dutch time on 21 October 2026, as reported by the sources listed at the end. PHP had announced on 20 October that fixes would follow, according to PHP’s own pre-announcement and NOS.
- Morning: Organisations started to take sites offline. According to NOS, MijnOverheid, DigiD, the website of the Tweede Kamer, the NCSC and the Autoriteit Persoonsgegevens were among them. The meeting system NotuBiz, used by around 100 municipalities, also went offline.
- 13:59: The NCSC published a notice about two critical PHP vulnerabilities. It said a public proof-of-concept existed, that it had not observed active exploitation, and that PHP planned updates for 16:00.
- 15:13: The Dutch government confirmed that several websites, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline as a precaution. Rijksoverheid.nl was not affected because it does not use PHP.
- Shortly before 16:00: PHP released the security updates. ENISA lists the release time as 13:40 UTC, which is 15:40 in the Netherlands.
- Before 17:00: The websites of RTL News and Tweakers were reachable again, as was the Finnish government website.
- Just after 18:00: MijnOverheid was back online.
- Around 20:30: The DigiD website returned. NOS noted that logging in with DigiD on other websites kept working while the DigiD site itself was down.
- Late evening: NOS reported that Overheid.nl, Meld Misdaad Anoniem, 113 and Centrum Seksueel Geweld were still offline, that NotuBiz worked only partly, and that government websites in Belgium and France were still unavailable.
2. The two PHP vulnerabilities
PHP is a programming language that runs on the server and is used by a very large share of websites; NOS put it at about 70 percent worldwide, including variants. WordPress and many other content-management systems are written in PHP. The flaws are in the PHP runtime itself, not in a single plugin or theme. According to PHP’s security advisory:
- CVE-2026-109618 (“RCE via OOM corruption”): when PHP runs out of memory it can be interrupted while request data is only partly initialised, and request cleanup may then treat the invalid data as valid.
- CVE-2026-109619 (“RCE via stale global state”): request-owned state can survive after its memory is freed, and a later request on the same worker may use it.
Both can allow an unauthenticated attacker to run code remotely. The NCSC said this can be triggered with a simple POST request and that all PHP versions from version 5 onward are vulnerable; Cloudflare puts the affected range at PHP 5.4 and later. PHP says all installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that the risk is highest for mod_php, where it has demonstrated an unauthenticated request triggering the attack before any application code runs. Embedded PHP in appliances and network devices is also affected. The issues are also referred to as PHP2Shell.
Fixed versions released on 21 October 2026 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, but minimal source backports exist for 7.4, 8.0 and 8.1. PHP says there is no complete mitigation and that updating is the only safe choice; temporary measures such as disabling session.upload_progress and restarting workers only limit specific attack paths. PHP 8.2 reaches end of life on 31 December 2026.
NOS reported that the first flaw was found on 11 August by researchers at Calif working with OpenAI, and the second on 24 August by Wiz.
3. Dutch websites that went offline
The NCSC advised website owners to assess their own risk and to consider taking systems offline until the fix was available, and it took its own website offline too. The sources name these Dutch organisations and services:
- Government: Overheid.nl, MijnOverheid.nl, DigiD, the Tweede Kamer, the NCSC and the Autoriteit Persoonsgegevens.
- Councils and public services: NotuBiz, the system behind the official documents of around 100 municipalities, provinces and water boards, as well as numerous hospital and municipality websites.
- Others: The Port of Rotterdam, the football association KNVB, the websites of the five largest political parties (Reuters), RTL News and Tweakers (NOS), and several higher-education systems (ANP, via NOS).
A website going offline is not, on its own, evidence of a data breach. According to NOS, many sites started again after the update, but some did not, and NotuBiz expected all pages to be back the next morning. For a guide to logging in and using these services, see our DigiD, MijnOverheid and Toeslagen guide.
4. Other European countries
On 21 October 2026 the European Commission (DG CNECT), ENISA, CERT-EU, Europol’s EC3 and the network of national EU CSIRTs issued a joint statement urging organisations to identify PHP-based applications, apply the updates with internet-facing systems first, and consider isolating exposed applications if they could not patch at once. Reuters reported that public bodies in several countries took websites offline:
- Germany: The federal IT service provider ITZBund took several websites offline. A spokesperson for the digital ministry said the step was purely preventive and that no security incidents were known.
- France: The Interior Ministry temporarily took prefecture websites offline while waiting for a patch for the PHP framework they use.
- Belgium: The foreign ministry took its websites offline after reports of cyberattacks that exploit the flaws, but the national cybersecurity centre said it had recorded no attacks on Belgian websites.
- Finland: The state IT centre Valtori shut down the government’s public web services as a precaution and said it had found no attempt to exploit the flaws.
- Czech Republic: The government took its website offline at 19:00 on the advice of the national cyber watchdog so that security patches could be installed.
- Wikimedia: The Wikimedia Foundation said systems it supports that use PHP are affected, and it took several offline until they could be patched safely.
Reports of shutdowns are not the same as confirmed intrusions: each operator has to determine whether its own systems were exposed and whether an attack succeeded.
5. What happened in Tรผrkiye
Anadolu Agency reported on 21 October 2026 that the Cyber Security Directorate of Tรผrkiye’s Presidency had started nationwide preventive security scans focused on the critical PHP vulnerabilities, concentrating on public institutions and also covering critical infrastructure. The agency said urgent security notices were sent to institutions and critical-infrastructure operators through the national SOME communication platform, asking administrators to review internet-facing systems, install security updates immediately, limit unnecessary external access and add protections where needed. The report describes a scanning and prevention effort; it does not say that Turkish government websites were taken offline.
6. Has the flaw been exploited?
The picture was mixed on 21 October 2026. The NCSC and the US agency CISA said they had not seen active exploitation, and the PHP Foundation said there were no signs that the flaws had been used to attack company websites. Cloudflare, however, said the vulnerability leaked before its official release and that it saw attack traffic aimed at its customers; it deployed firewall protections, which it said block these attempts, and stressed that updating PHP is still necessary. In Belgium, the foreign ministry cited reports of attacks while the national cybersecurity centre recorded none. Traffic aimed at the flaw is evidence of attempts, not proof that any particular organisation was compromised. Treat all of this as a snapshot: the NCSC says that until a system is updated, any system with PHP that is reachable from the public internet is presumably vulnerable.
7. What website owners should do
The advice below comes from the NCSC, ENISA and PHP:
- Check as soon as possible whether your systems use PHP and which version they run, starting with internet-facing and web-serving systems.
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the update from your Linux distribution or LTS vendor, who may ship backported packages.
- Check third-party images, appliances and embedded PHP separately, because you may not be able to update those yourself. Watch for vendor updates.
- If you cannot update at once, apply PHP’s temporary measures and consider keeping the system offline or isolated from public networks until it is updated. The NCSC published a decision tree (“Handreiking beslisboom”) to help choose.
- Keep a web application firewall enabled if you have one, but do not treat it as a replacement for the update. Updating a WordPress theme or plugin does not patch the PHP runtime.
- Follow advisory NCSC-2026-0443 and the PHP security advisory for new information.
If your site runs on a hosting plan, ask your host which PHP version your account uses and whether the security update is installed. Our report on a separate cybersecurity incident at Albert Heijn shows how quickly services can be affected.
8. What ordinary users should know
Most visitors do not need to update anything: PHP runs on the server, so the responsibility sits with the website operator or hosting provider, and the government notice gave no specific advice to citizens. An unavailable website does not mean you were hacked, and a WordPress site is not automatically compromised, because the risk depends on the PHP version and configuration. As general good practice, look for updates on an organisation’s official website and be wary of unexpected messages asking you to sign in to a replacement portal; our expat scam guide explains how to spot phone and phishing scams.
9. FAQ
What are the PHP vulnerabilities?
Two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can allow an attacker to run code on a server remotely, without logging in, according to PHP, the NCSC and ENISA.
How serious are they rated?
PHP’s pre-announcement of 20 October rated both CVSS v4.0 9.2, and the 21 October advisory calls them critical.
Is my DigiD safe?
The NCSC said it had not observed active exploitation on 21 October 2026. The DigiD website was taken offline as a precaution and was back around 20:30, and DigiD login on other websites kept working in the meantime, according to NOS.
Which PHP versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Minimal source patches exist for 7.4, 8.0 and 8.1.
Could websites go offline again?
NOS wrote on the evening of 21 October that sites going offline again later that evening or the next day seemed unlikely, but noted that updates can fail and that many people downloading the update at once can overload servers. Check the NCSC for the latest status.
Where can I find the latest information?
On the NCSC advisories page (advisories.ncsc.nl), the NCSC technical page on GitHub and the PHP security advisory.
๐ณ๐ฑ Dutch Corner
| Dutch | English |
|---|---|
| De kwetsbaarheid | Vulnerability |
| Het beveiligingslek | Security flaw |
| De beveiligingsupdate | Security update |
| Preventief offline halen | To take offline as a precaution |
| De storing | Outage, disruption |
| De aanval | Attack |
| De gegevens | Data, information |
| Bijwerken | To update |
| Het Nationaal Cyber Security Centrum (NCSC) | National Cyber Security Centre |
| Weer online | Back online |
Sources
- PHP.net, 21 October 2026: Critical remote code execution vulnerabilities, update now (CVE descriptions, fixed versions, affected setups, no complete mitigation; the 20 October pre-announcement gives CVSS v4.0 9.2)
- ENISA, 21 October 2026: Joint statement on critical PHP vulnerabilities (European Commission, ENISA, CERT-EU, Europol EC3 and EU CSIRTs network; release time and advice)
- Rijksoverheid, 21 October 2026, 13:59: NCSC: Ernstige kwetsbaarheden in PHP (public proof-of-concept, no active exploitation seen, all versions from 5, advice)
- Rijksoverheid, 21 October 2026, 15:13: Aantal websites Rijksoverheid preventief offline na kwetsbaarheden PHP (Overheid.nl, MijnOverheid, DigiD; Rijksoverheid.nl not affected)
- NCSC, 21 October 2026: Kwetsbaarheden PHP: patches beschikbaar, update nu (fixed versions, older branches, mitigations, advisory NCSC-2026-0443)
- NCSC-NL on GitHub: php2shell (technical details, affected configurations, advice; last updated 21 October 2026, 17:25)
- NOS: Websites van overheid en in onderwijs offline vanwege lek, risico op hacks (affected Dutch sites, Cloudflare, NCSC statement)
- NOS: Websites komen langzaam weer online na beveiligingsupdate in programmeertaal PHP (recovery times, PHP Foundation and CISA statements)
- NOS: Nog altijd websites niet bereikbaar na lek, ook internationaal nog problemen (sites still offline, Belgium and France, discovery dates, 70 percent figure)
- Reuters, 21 October 2026 (published via Euronext): Factbox: Websites taken offline over PHP risks (Germany, France, Belgium, Finland, Czech Republic, Wikimedia, Dutch organisations)
- Cloudflare, 21 October 2026: Cloudflare deploys protections against php2shell vulnerability (leak before release, attack traffic, firewall protections)
- Anadolu Agency, 21 October 2026: Siber Gรผvenlik Baลkanlฤฑฤฤฑnca kritik gรผvenlik zafiyetlerine karลฤฑ ulusal รถlรงekte tarama baลlatฤฑldฤฑ (Tรผrkiye’s nationwide preventive scans)
Free: Netherlands 2027 Money Checklist
Every deadline and number you need before and after 1 January 2027, on two printable pages. Confirm your email and the PDF is yours; we will also email you when the 2027 figures are confirmed.
Read nextBusiness & FinanceSole Proprietorship or BV in the Netherlands: Which Legal Form Fits You?
