PHP flaw takes government websites offline

On October 21, 2026, Dutch government websites were taken offline as a precaution after a warning about two serious PHP vulnerabilities. Both flaws received a severity score of 9.2 out of 10. The website of the Dutch House of Representatives, the National Cyber Security Centre and the government platform NotuBiz were temporarily made unavailable. This does not mean those websites were hacked, but it shows how many services depend on the same technology.

Two flaws could let attackers control a web server remotely

PHP is software used to process information and build web pages before they appear in your browser. It powers familiar systems such as WordPress, Drupal, Joomla and Magento. Hosting providers, government websites and other online services may also use PHP without visitors noticing.

On October 20, CERT EU, the cybersecurity service for European Union institutions, warned about two critical vulnerabilities. They are registered as CVE 2026 109618 and CVE 2026 109619. According to the advisory, an attacker may be able to execute malicious code on a vulnerable server without logging in first.

What does that mean? A server is a computer that makes a website or online service available. Remote code execution means an attacker can send commands to a server over a network connection. What the attacker can do next depends on the vulnerability and the system's security.

The official PHP announcement rated both flaws 9.2 on the CVSS version 4.0 scale. That is a critical rating. At the time of the initial warning, the technical details and fixed versions had not been made public. Administrators could prepare, but could not yet install the final fix everywhere.

The Dutch parliament and other services went offline as a precaution

The situation in the Netherlands shows this is not just a theoretical concern for website developers. According to ANP reporting, the website of the Dutch House of Representatives, the NCSC website and parts of the shared SURF network were taken offline as a precaution. NotuBiz, a platform used by more than one hundred local government bodies to publish official notices, was also temporarily shut down.

Municipalities, provinces and water authorities use NotuBiz to share information with elected representatives and the public. When such a platform is unavailable, visitors may temporarily be unable to read official notices through that route. This is a consequence of the precautionary measure, not automatic evidence of a successful attack.

Other organisations are assessing their exposure too. The United Kingdom's National Cyber Security Centre advised organisations to identify systems running PHP, monitor internet traffic and install the security update as soon as it becomes available. Australia's cybersecurity authority also issued a critical alert.

There is no confirmation that every service mentioned has been hacked. At the time of its alert, the Australian authority said it was not aware of active exploitation of these specific vulnerabilities. According to the reporting, the Dutch services that went offline did so as a precaution.

WordPress sites, online stores and hosting providers need to check PHP

The vulnerabilities are in PHP itself. A website may therefore be exposed even if WordPress or its online store software is fully updated. Updating a website does not always update the PHP software running on the server.

The warning may be relevant to several types of services:

• WordPress websites and blogs.
• Drupal and Joomla websites used by businesses and institutions.
• Online stores that use Magento or other PHP software.
• Hosting environments, control panels and software that includes PHP.
• Government and education websites that use PHP.

CERT EU says all PHP versions from version 5 onwards may be affected. This is a broad indication, not a final list of affected versions. The official PHP documentation should provide the exact version information when the security release becomes available.

A vulnerable PHP installation also does not mean every website using PHP is automatically vulnerable. The configuration and exact software version matter. Still, administrators should check not only their own website but also ask their hosting provider which components run on the server.

Taking a website offline may prevent more damage than it causes

Temporarily shutting down a website is inconvenient. Visitors cannot find information and some services stop working. For a local authority, a publication may be temporarily unavailable. For a business, customers may not be able to use its website.

In numbers: Suppose an online store normally processes 80 orders per day and earns an average of €25 in revenue per order. A full day without checkout would represent €2,000 in potential revenue that does not pass through the website. This is an illustrative calculation, not a confirmed loss at an existing store. Lost revenue is also not the same as lost profit.

An attack on a vulnerable server could have more serious consequences. Depending on the circumstances, an attacker could access data, modify files or use the server to launch further attacks. Recovery work, investigations and customer notifications can also cost money.

The decision to take a website offline depends on the risk and the measures available. If the administrator cannot fix the vulnerability yet, restricting access may be a sensible temporary security measure. That is the approach described in the CERT EU and UK NCSC advisories.

Ordinary users do not need to distrust every website, but should check their own services

As an ordinary internet user, you do not need to assume every website you visit is dangerous. A website taken offline as a precaution has not necessarily been hacked. The vulnerability may exist on the server rather than on the phone or computer you use to visit it.

Use official websites or apps for important services and look for messages from the organisation itself. If you receive an unexpected email claiming that your account needs to be secured again because of this flaw, do not open its link automatically. Navigate to the organisation's known website yourself.

If you manage a website, the situation is different. You need to know which PHP version is active and who manages it. Automatic updates for WordPress or an online store do not necessarily fix this issue.

Watch out: Do not install an unknown patch sent through email or a forum. Wait for the PHP security update or an update from your hosting provider or software vendor. After installation, verify that the server is actually running the fixed version.

These are the checks to make today

The official PHP announcement scheduled the release for October 21, 2026 at 14:00 UTC, which is 16:00 in the Netherlands and Belgium. The timing may change if new technical information or evidence of exploitation becomes public earlier. Check the current PHP announcement rather than relying only on a news story published earlier in the day.

If you manage a website, these are the main questions to ask:

• Which PHP version is running on my website and server?
• Who will install the PHP security update?
• Are additional services and software that bundle PHP also being checked?
• What is the temporary plan if the update is not immediately available?
• Are there unusual requests, files or processes that need investigation?

If you only visit websites, you do not need to install a patch on your own device because of this server vulnerability. Keep your devices updated and watch out for messages that exploit the news.

Sources

• PHP, Upcoming Critical PHP Security Release, October 20, 2026
• CERT EU, Critical Vulnerabilities in PHP, October 20, 2026
• National Cyber Security Centre, Critical security issue affecting PHP, October 21, 2026
• Australian Cyber Security Centre, Critical vulnerabilities in PHP, October 21, 2026
• ANP via RD, Various websites offline following PHP warning, October 21, 2026
• BitFox, Germany's largest banking group opens crypto trading to millions

This article is for educational purposes and is not advice.