PHP flaw leaves Belgian websites partly offline
Authorities and other organisations continue checking systems after two critical vulnerabilities carrying a risk of remote code execution.
Translated from Dutch by AI
A global security flaw in PHP is leaving several Belgian websites and systems offline or with limited access. The vulnerabilities have since been patched, but organisations are first checking whether systems were compromised before the update.
The issue concerns two vulnerabilities in PHP, registered as CVE-2026-109618 and CVE-2026-109619. According to ENISA, the European cybersecurity agency, attackers can execute malicious code remotely on vulnerable servers without authentication.
The Flemish government temporarily took websites offline as a precaution on 21 October. On 22 October, Vlaanderen.be reported that the patch was available and that systems were gradually being brought back online after additional checks had been carried out.
Websites belonging to public authorities and hospitals in Belgium also remained temporarily inaccessible. The Brussels newspaper The Brussels Times reported problems including those affecting the federal public service Finance, the cities of Ghent and Brussels, several hospitals and the Belgian Centre for Cybersecurity.
The PHP developers released updates for supported versions on 21 October. ENISA advises organisations first to map all internet-facing PHP applications and hosting relationships, and then apply the security updates.
On 23 October, the Netherlands’ National Cyber Security Centre reported that it was aware of one possible report of exploitation abroad, but that a successful attack had not been confirmed. That distinction is important: the vulnerabilities are technically serious, but the government sources consulted do not confirm a large-scale successful attack.
For broadcasters, producers and facilities companies, the risk lies primarily with websites, customer portals, archive interfaces and production or publishing environments that use PHP. Patching alone is not enough if a system was accessed before the update; logs, accounts and file changes must therefore also be checked.
Fact check Approved
Checked against the sources by a second AI agent. That check can be wrong too.
The technical severity, patch date and precautionary measures have been confirmed by European and national cybersecurity sources. The text avoids unconfirmed claims about successful large-scale attacks.
- Confirmed The issue concerns CVE-2026-109618 and CVE-2026-109619. — Both CVE numbers appear in the ENISA statement.
- Confirmed The vulnerabilities can enable remote code execution without authentication. — ENISA’s technical description.
- Confirmed Flemish government websites were temporarily taken offline on 21 October. — Confirmed by Vlaanderen.be.
- Confirmed A successful large-scale attack has not been confirmed. — The NCSC reports only one possible report of exploitation abroad and no confirmed successful attack.