NCSC investigates first signs of PHP vulnerability exploitation
The cyber centre warns organisations to patch their systems immediately or keep them offline.
Follow-up to: DigiD and MijnOverheid offline after critical PHP vulnerabilities Wednesday, 21 October 2026, 15:27
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
The National Cyber Security Centre is investigating the first signs that the two critical vulnerabilities in PHP have been successfully exploited. The NCSC does not say that the signs have been confirmed, but calls the situation urgent because working attack techniques are publicly available.
The warning appears in an NCSC update that, according to the publication details, was posted at 4pm on Thursday. According to the cyber centre, several websites have come back online since security updates became available, but organisations that have not yet updated their systems should keep them offline as a precaution.
The vulnerabilities are in the PHP programming language. According to the PHP developers, attackers can execute code remotely without login credentials. The two flaws have the identification numbers CVE-2026-109618 and CVE-2026-109619 and were classified as ‘critical’.
The NCSC writes that it is investigating the first signs of successful exploitation. That statement alone does not make clear which systems have been affected, who is behind any attacks or how many organisations are at risk. The NCSC says that so-called proof-of-concepts are available: examples showing that the vulnerabilities can in principle be exploited.
The PHP organisation has released updates for versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. According to the PHP organisation, limited source-code patches have been made available for older versions because of the seriousness of the flaws, but PHP 8.1 and older versions are no longer routinely maintained by the project. The NCSC also advises organisations to follow updates from their Linux distribution or other software supplier.
According to the NCSC, government websites were among those previously taken offline as a precaution, and the centre itself also did so temporarily. According to the AP news agency, websites and services in countries including the United Kingdom, Finland and Japan were also temporarily disabled while administrators investigated the vulnerability.
The situation shows that the release of a patch does not mean the risk has immediately passed. Organisations must establish which PHP version and applications they use, check that updates have been installed correctly and continue monitoring systems for unusual activity. The NCSC says temporary measures only limit specific attack paths; according to the centre, full remediation of the vulnerability is possible only with a security update.
One story, several perspectives
What is established
- The NCSC is investigating the first signs of successful exploitation.
- The vulnerabilities can put systems at risk remotely.
- The NCSC advises organisations to patch immediately or temporarily take systems offline.
- The government is not requiring vulnerable websites to close under a general statutory order.
Left
Arguments The government and large technology companies share responsibility for digital security. Organisations should be given room to patch quickly, even if this temporarily disrupts public services.
Values Protecting citizens, public services and workers; digital security as a public concern.
Consequences More public support and stricter security requirements could reduce risks, but would require funding and could place a heavy burden on smaller organisations.
Centre
Arguments The proportionate approach is to patch immediately, assess risks for each system and disable services temporarily only where necessary. Transparent information about incidents is important as well.
Values Continuity, proportionality, expert oversight and practicality.
Consequences Targeted measures limit damage without unnecessarily bringing all digital services to a standstill.
Right
Arguments Organisations should primarily be responsible for keeping their systems up to date. The government should issue clear warnings, but be cautious about introducing additional rules and liability.
Values Individual responsibility, freedom of enterprise and a limited government.
Consequences Lower regulatory burdens may support innovation and speed, but poorly secured organisations may continue exposing citizens and other companies to risks.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The article’s central claim is based directly on the NCSC’s update of 22 October. Technical details and international context were checked against PHP, AP and Reuters; the article clearly distinguishes between signs under investigation and confirmed attacks.
- confirmed The NCSC is investigating the first signs of successful exploitation of the PHP vulnerabilities. — Stated literally as a substantive announcement in the NCSC update of 22 October. source
- confirmed There are two critical PHP vulnerabilities with the CVE numbers CVE-2026-109618 and CVE-2026-109619. — Confirmed in the PHP security advisory. source
- confirmed The vulnerabilities can enable unauthenticated remote code execution. — PHP describes unauthenticated remote code execution; AP gives the same technical explanation. source
- confirmed Updates are available for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. — The version numbers appear in the NCSC and PHP publications. source
- confirmed Websites in the United Kingdom, Finland and Japan were also temporarily taken offline. — AP names these countries in its reporting on the international consequences. source
- confirmed South Korea raised its cyber alert level because of the PHP vulnerabilities. — Reuters reports the measure and the circulation of security advice. source
Editor's note
It is certain that the NCSC is investigating the first signs of possible successful exploitation and that patches are available. The scale, victims and perpetrators remain uncertain; the NCSC has not yet confirmed those details.Sources
- Update: PHP-kwetsbaarheden nog steeds reden om direct te patchen — Nationaal Cyber Security Centrum
- PHP vulnerabilities: Who's exposed and how AI both helps and hurts security — Associated Press
- Security advisory: Critical remote code execution vulnerabilities, update now — PHP
- South Korea activates emergency response to PHP security flaws — Reuters
The story so far
- Wednesday, 21 October 2026, 08:13 PHP warns of two critical security vulnerabilities
- Wednesday, 21 October 2026, 11:12 Attacks via PHP flaws reported, evidence remains limited
- Wednesday, 21 October 2026, 15:27 DigiD and MijnOverheid offline after critical PHP vulnerabilities
- Wednesday, 21 October 2026, 18:26 PHP issues security patch; websites can return after update
- Thursday, 22 October 2026, 19:34 NCSC investigates first signs of PHP vulnerability exploitation (this article)
More on this in Dutch media
- de Volkskrant — „php cyberveiligheid”
- NOS — „php cyberveiligheid”
- Het Parool — „php cyberveiligheid”