PHP vulnerability October 2026: which websites are offline and what's happening
On Wednesday 21 October 2026, more than a hundred organisations in the Netherlands took websites offline as a precaution: from DigiD and MijnOverheid to municipalities, hospitals, universities, transport operators, RTL and football clubs. The cause is not an outage, but two critical security vulnerabilities in PHP, the programming language that most of the web runs on. Here you can read what is known, which sites are offline right now and what you need to do.
Two critical vulnerabilities in PHP are the reason so many websites are offline. The security update is scheduled for 21 October at 16:00. Until then, organisations are taking their sites offline as a precaution.
Below you can see live which well-known websites are currently unreachable, the timeline, which organisations have been affected and what to do as a user or as a website owner.
Live: which websites are offline right now
This overview checks every 2 minutes whether the websites of a range of organisations are reachable. That way you can see which sites are still down and when they come back. The list includes organisations named in the news coverage, plus a few large government sites for comparison.
Loading the overview.
From an Appfront server, we measure whether the public homepage loads. We do not test logging in with DigiD. A page that only shows a maintenance message does not count as normally reachable. Is your own platform running on PHP and are you unsure? Have a developer take a look.
What is going on
- On 20 October, the PHP security team announced two critical vulnerabilities, each with a severity score of 9.2 out of 10.
- According to CERT-EU, the vulnerabilities are CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell.
- The NCSC says any system running PHP that is reachable from the internet is presumed vulnerable.
- The update will be released on 21 October at 16:00 Dutch time. No update will be released for PHP 8.1 and older.
- Taking sites offline is a precaution. No Dutch organisation is known to have been breached through this vulnerability.
On Tuesday 20 October, the PHP security team published an announcement from the PHP security team about two critical vulnerabilities, both with a CVSS 4.0 score of 9.2. The technical details remain secret until the release, but according to security researchers the flaws allow an attacker to execute code remotely on a vulnerable server. That is the most serious category: anyone who can execute code can, in principle, reach everything on that server.
On Tuesday evening, the European CERT-EU named the identifiers CVE-2026-109618 and CVE-2026-109619 and wrote that possibly all PHP versions from PHP 5 onwards are affected. Its advice: isolate systems that are reachable from the internet if they cannot be patched immediately. That is exactly what many Dutch organisations did on Wednesday morning.
Reports on exploitation differ. According to Reuters, Cloudflare said on Wednesday morning that it was seeing the first attacks and switched on additional filtering rules, including for free customers. Around 1 pm, the NCSC (the Dutch National Cyber Security Centre) said it had not yet seen any active exploitation. At the time of writing, no confirmed breach via this vulnerability is known.
The timeline
- Tuesday 20 October
The PHP security team announces two critical vulnerabilities and a security update for Wednesday at 2 pm UTC.
- Tuesday 20 October, evening
CERT-EU publishes an advisory with the CVE identifiers and recommends isolating internet-facing systems.
- Wednesday 21 October, morning
Cloudflare reports the first attacks and deploys filtering rules. The Tweede Kamer (the Dutch House of Representatives), NotuBiz and parts of SURF go offline.
- Wednesday 21 October, around 11 am
DigiD, MijnOverheid, RTL, Tweakers, the NCSC, the Dutch Data Protection Authority and the council information systems of around a hundred municipalities are offline.
- Wednesday 21 October, afternoon
Provinces, hospitals, universities of applied sciences, transport operators, football clubs and political parties follow. The NCSC still sees no active exploitation.
- Wednesday 21 October, 4:00 pm
The scheduled release of the security updates. After that, organisations install the update and sites come back step by step.
This article was updated on 21 October at around 2.30 pm, before the release. Exactly which PHP versions are vulnerable and which version contains the fix will only be announced by the PHP security team at the release. Researchers expect versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but this has not yet been confirmed.
Which organisations are affected
The list below is compiled from reports by NOS, the NOS live blog, RD/ANP and regional broadcasters, among others. It is not exhaustive: according to Omroep West, 25 municipalities in the Haaglanden region alone were affected, and according to RTV Utrecht, 21 municipal websites in Utrecht were completely unreachable. Not every organisation took everything offline. For some, logging in or part of the service kept working.
Organisations that took websites offline, according to reports of 21 October
| Sector | Organisations | Source |
|---|---|---|
| Central government and oversight | DigiD, MijnOverheid, Tweede Kamer, NCSC, Dutch Data Protection Authority | NOS |
| Provinces and water boards | Provinces of Groningen, Friesland and Gelderland, Association of Water Boards | NOS live blog |
| Municipalities | Council information for around a hundred municipalities via NotuBiz; websites of Purmerend, The Hague, Leiden, Delft, Zoetermeer, Eindhoven, Moerdijk, Drimmelen, Maastricht, Venlo, Heerlen and Sittard-Geleen, among others | NOS, RegioPurmerend, Omroep West, Omroep Brabant, L1 |
| Education | TU Delft, The Hague University of Applied Sciences, Zuyd University of Applied Sciences, Summa College, parts of SURF and the University of Twente | Omroep West, L1, Omroep Brabant, RD/ANP |
| Healthcare | Maastricht UMC+, Jeroen Bosch Hospital, ETZ, Bravis, Haaglanden MC, St. Antonius Hospital and more | RD/ANP, Omroep Brabant, Omroep West, RTV Utrecht |
| Transport | EBS, RET, Maastricht Aachen Airport, ANWB. NS expected no impact | RegioPurmerend, L1, Omroep West, RD/ANP |
| Media, sport and other | RTL, Tweakers, KNVB, FC Twente, Willem II, Fortuna Sittard, ADO Den Haag, FC Groningen, Hoogvliet, WML and a number of political parties | NOS, NOS liveblog, Omroep West, L1 |
Why this vulnerability affects so many websites
PHP has been the standard language for websites for well over twenty years. WordPress, Drupal, Joomla, Magento and Laravel all run on it, as do countless custom portals. According to W3Techs, 69 per cent of the websites whose server-side language is known use PHP. A critical vulnerability in PHP therefore doesn't affect a single vendor, but the foundation beneath a large part of the web.
On top of that, many of those sites run on a version that no longer receives updates. These sites can't simply be patched after 4pm. They first have to move to a supported version, and that takes time.
Which PHP versions websites use, as a share of all PHP sites (W3Techs, 21 October 2026, rounded)
| PHP version | Share | Status |
|---|---|---|
| PHP 8.2 to 8.5 | 51% | Supported, expected to receive an update |
| PHP 8.0 and 8.1 | 14% | No longer supported, no update |
| PHP 7 | 27% | No longer supported since 2022 or earlier |
| PHP 5 and older | 8% | Unsupported for years |
The percentages are calculated from W3Techs' figures on PHP versions and the breakdown within PHP 8. The end-of-life dates per version are listed in the overview of supported versions on php.net. Taken together, this means that almost half of PHP sites run on a version that will not receive a security update for this vulnerability. According to Tenable, researchers estimate the number of potentially vulnerable servers worldwide at more than 1.3 million.
What you need to do
What to do, depending on your role
| You are | Today | After the update |
|---|---|---|
| A user of a service such as DigiD | Try again later. Don't click on links in messages about the outage | Simply log in again via the usual web address |
| The owner of a website or web shop | Look up your PHP version and ask your hosting provider about their schedule | Check that the new version is active and everything works |
| An administrator or developer | Take stock of your systems, enable protection, get the update ready | Install the update, restart PHP-FPM, review the log files |
If you have your own website, read how to check whether your website is vulnerable. It covers the four ways to find your PHP version and a decision guide for whether you should take your site offline temporarily. If you use WordPress, also read what the vulnerability means for WordPress sites. If you want to know what the outage means when you need to log in to government services, read the article on DigiD and MijnOverheid.
During major outages, scammers send messages with a link to log in again or recover an account. Don't click on them. Always go to the service's usual web address yourself.
the severity score out of 10 (CVSS 4.0) for each of the two vulnerabilities, according to the PHP security team.
of websites with a known server-side language run on PHP, according to W3Techs.
of PHP sites run on a version that no longer receives updates, calculated from W3Techs data.
the scheduled time of the security update on 21 October (2 pm UTC).
Frequently asked questions
About the PHP vulnerability of October 2026.
What is the PHP vulnerability of October 2026?
Two critical vulnerabilities in PHP, the programming language behind a large share of all websites. They were announced on 20 October 2026, each received a severity score of 9.2 out of 10 and are also known as PHP2Shell. According to CERT-EU, they are CVE-2026-109618 and CVE-2026-109619.
Which websites are offline?
Among others, DigiD, MijnOverheid, the House of Representatives, the NCSC, the Dutch Data Protection Authority, dozens of municipalities, hospitals, universities of applied sciences, transport operators such as EBS and RET, RTL and football clubs. The live overview at the top of this article shows which sites are currently unavailable.
Why are organisations taking their websites offline?
As a precaution. Until the update is available, a server running PHP that is reachable from the internet may be vulnerable. Taking the site offline means no one can exploit the vulnerability.
Is the vulnerability already being exploited?
Reports differ. On Wednesday morning Cloudflare said it was seeing the first attacks, while at around 1 p.m. the NCSC (the Dutch National Cyber Security Centre) had not yet seen any active exploitation. No confirmed breach via this vulnerability is known.
When will the websites be back online?
The update will be released on 21 October at 4 p.m. After that, organisations need to install it and check their systems. How long that takes differs per organisation.
Do I need to do anything as a website owner?
Yes, if your site runs on PHP. Look up your PHP version, ask your hosting provider when they will install the update, and check afterwards that everything works. If you run PHP 8.1 or older, no update will be released and you will need to upgrade.
Further reading
How to check your website
Find your PHP version and decide whether to go offline temporarily.
Read more WordPressWordPress and the PHP vulnerability
Who installs the update and what you should check yourself.
Read more GovernmentDigiD and MijnOverheid offline
What the outage means if you want to log in to government services.
Read moreDoes your platform run on PHP? We can help
Appfront builds and maintains digital platforms, from webshops to government portals. Not sure which PHP version you are running, or want the next update to stop being a stressful day? Book a conversation with a developer.