Attacks via PHP flaws reported, evidence remains limited
Security services warn of two critical vulnerabilities as websites and government portals take precautions.
Follow-up to: PHP warns of two critical security vulnerabilities Wednesday, 21 October 2026, 08:13
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Following warnings about two critical vulnerabilities in PHP, several media outlets are reporting attacks on websites that use the programming language. Independent confirmation of large-scale successful attacks is so far lacking, while organisations prepare for security updates.
The European cybersecurity service CERT-EU warned of two vulnerabilities in PHP that could potentially allow remote code execution. The service published the warning on 20 October and advised organisations to install the security update as soon as it becomes available.
According to CERT-EU, the vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities have a provisional CVSS score of 9.2, according to the service, indicating a potentially very serious flaw. CERT-EU said technical details were not yet public when the warning was issued.
The PHP organisation had announced that it would release a security update at 14:00 UTC on 21 October. Administrators can install the official solution as soon as it becomes available.
Dutch media report that attackers are already attempting to exploit the vulnerabilities. According to those reports, council information portals of municipalities, provinces and water authorities have also been taken offline as a precaution. However, the publicly available CERT-EU warnings do not state that a specific attack in the Netherlands or large-scale successful exploitation has been established.
The potential impact is significant because PHP is used on many web servers and in many content management systems. A vulnerability that enables remote code execution could, in the worst case, lead to a server takeover, data theft or disruption of a website. This is a risk assessment, not an established finding that this has already happened in this case.
According to CERT-EU, administrators should first establish where PHP is being used and prepare systems for immediate installation of the official patches. Where repair cannot be carried out immediately, the service advises limiting internet access to vulnerable applications. The number of systems actually attacked and the number of organisations affected have not yet been made public.
One story, several perspectives
What is established
- CERT-EU warns of two critical vulnerabilities in PHP.
- The official security update was announced for 14:00 UTC on 21 October 2026.
- The scale of any attacks and the consequences for Dutch organisations have not been established.
Left
Arguments The situation shows that digital security is a public responsibility. Critical software that is widely used across society requires structural investment in maintenance, open standards and support for organisations that lack sufficient capacity themselves.
Values Collective security, accessibility and protection of public services.
Consequences Without public support, municipalities, small businesses and civil-society organisations in particular may remain vulnerable to flaws in essential software.
Centre
Arguments The institutional approach is to establish the facts first, wait for the official patch and provide targeted assistance to organisations with isolating and restoring systems. Measures should be proportionate and based on demonstrable risk.
Values Continuity, proportionality and reliable information.
Consequences Taking too little action increases the risk, but taking systems offline in an uncoordinated manner can unnecessarily disrupt public services.
Right
Arguments Organisations operating internet services should remain responsible for patching, segmentation and limiting exposure themselves. Reliance on widely used open software is no excuse for poor management.
Values Individual responsibility, resilience and limited government intervention.
Consequences Stricter liability and higher security requirements could improve digital resilience, but also increase costs for small organisations.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved with corrections · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The vulnerabilities, severity classification and planned release have been confirmed by CERT-EU. The claim that large-scale attacks are already taking place has not been independently established and has therefore been softened.
- confirmed CERT-EU published a warning on 20 October 2026 about two critical PHP vulnerabilities. — Mentioned in the official CERT-EU warning. source
- confirmed The vulnerabilities could potentially allow remote code execution. — CERT-EU describes potential unauthenticated remote code execution. source
- confirmed The vulnerabilities have a provisional CVSS score of 9.2. — Mentioned in CERT-EU's technical summary. source
- uncertain Large-scale successful attacks have already been established. — The public primary warning does not confirm active successful exploitation. source
1 correction(s) applied
- Was: Attackers are carrying out major cyberattacks worldwide through the PHP flaws.Now: Several media outlets report attacks, but independent confirmation of large-scale successful exploitation is lacking. (The primary public warning does not confirm active large-scale exploitation.)
Editor's note
The vulnerabilities and the planned security update have been confirmed by CERT-EU and PHP. Reports of active attacks and Dutch portals being taken offline could not be independently confirmed with a primary source; this article is therefore labelled insufficient_sources.Sources
The story so far
- Wednesday, 21 October 2026, 08:13 PHP warns of two critical security vulnerabilities
- Wednesday, 21 October 2026, 11:12 Attacks via PHP flaws reported, evidence remains limited (this article)
More on this in Dutch media
- Trouw — „php cybersecurity”
- NU.nl — „php cybersecurity”
- De Telegraaf — „php cybersecurity”