PHP issues security patch; websites can return after update
Developers have fixed two critical vulnerabilities, but administrators still need to update their systems.
Follow-up to: DigiD and MijnOverheid offline after critical PHP vulnerabilities Wednesday, 21 October 2026, 15:27
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
PHP developers released security updates on Wednesday for two critical vulnerabilities. Websites taken offline as a precaution can gradually return, but the risk is only reduced after the servers have actually been updated.
The new versions of PHP 8.5, 8.4, 8.3 and 8.2 contain fixes for two vulnerabilities that, in certain circumstances, allow an attacker to execute code remotely without first logging in. The PHP developers say updating is the only complete solution.
The vulnerabilities prompted precautionary measures. According to Reuters, organisations in several European countries temporarily took government, education and hospital websites offline. In the Netherlands, these included Overheid.nl, the websites of the port of Rotterdam and the KNVB, political-party websites and hospital sites.
Websites can come back online once the security update has been processed. Checks are needed: organisations must not only update PHP, but also verify which version is actually running on the server and whether connected software remains vulnerable.
The UK's National Cyber Security Centre writes that one of the vulnerabilities can cause a memory error that, under certain conditions, can be exploited to execute malicious code. The agency advises organisations that cannot yet update to further isolate their systems or keep them temporarily offline.
There is not yet a complete picture of exploitation. Reuters reported that Cloudflare saw early attacks emerging, while Australia's cyber security agency said it had not identified any active exploitation. That difference means organisations cannot simply wait for confirmation of an attack: the vulnerability itself has now been fixed, but not automatically on systems still using an old version.
For Dutch users, public and commercial websites may become accessible again after updating. A website that is back online is not automatically safe; its security status depends on the installed version, any additional software and checks for signs of previous access. Administrators of older PHP versions should determine whether a security update is available for their version.
Also show where in Europe and in the world
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article's central points are directly confirmed by PHP, Reuters and the UK's NCSC. Uncertainty about active attacks and the pace of recovery is explicitly described as uncertainty.
- confirmed PHP released updates for versions 8.5, 8.4, 8.3 and 8.2. — Mentioned in the official PHP release information. source
- confirmed Under certain conditions, the vulnerabilities can lead to remote code execution without authentication. — PHP and the UK's NCSC describe this risk. source
- confirmed Dutch government, port, political and hospital websites went offline as a precaution. — Reuters mentions these Dutch examples. source
- confirmed Cloudflare saw early attacks, while Australia had not identified any active exploitation. — Both observations appear in the Reuters factbox. source
- confirmed Not every website that comes back online is automatically safe. — This follows from the official instruction that an actual update is necessary. source
Editor's note
It is certain that PHP has released updates and that organisations took websites offline as a precaution. Recovery is proceeding organisation by organisation; the scale of actual attacks has not yet been established.Sources
- PHP security release fixing two critical vulnerabilities — PHP
- Factbox: Websites taken offline over PHP risks — Reuters via Euronext
- Critical security issue affecting PHP — National Cyber Security Centre
The story so far
- Wednesday, 21 October 2026, 08:13 PHP warns of two critical security vulnerabilities
- Wednesday, 21 October 2026, 11:12 Attacks via PHP flaws reported, evidence remains limited
- Wednesday, 21 October 2026, 15:27 DigiD and MijnOverheid offline after critical PHP vulnerabilities
- Wednesday, 21 October 2026, 18:26 PHP issues security patch; websites can return after update (this article)
More on this in Dutch media
- de Volkskrant — „php cybersecurity”
- NOS — „php cybersecurity”
- Het Parool — „php cybersecurity”