Skip to content
NL Nederlands Contact Nederlands

Available now Outside office hours (CET) Available on weekdays, 08:30–18:00 CET

A real person who helps you think it through

Contact

In the news

Worldwide security flaw in PHP: what it means for your website

On 20 October 2026 a serious flaw came to light in PHP, the software that many websites worldwide run on. It sits in PHP itself, not in the websites we built. PHP released the update on 21 October. Here is what happened, whether your website should go offline and what you can do.

Ask your question Urgent? Call +31 85 001 4321
  • Hosted with us? The update has been in since 21 October
  • Sites taken offline are back online

01 The situation

What is going on?

On 21 October 2026 the Dutch National Cyber Security Centre (NCSC) advised treating every website that runs on PHP as vulnerable until the update is installed. That is why sites such as MijnOverheid, DigiD and the Dutch House of Representatives went offline that day as a precaution.

  • The flaw is in PHP itself

    So it affects every site that runs on it: WordPress, Laravel, Magento and custom builds. Updating WordPress or plugins does not help.

  • Remote takeover

    An attacker can run their own code on the server without logging in. PHP rates both flaws as critical.

  • Attack attempts seen

    The details leaked on 20 October. Cloudflare saw attack attempts on 21 October; the NCSC had not confirmed any misuse that day.

  • The update has been out since 21 October

    PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 that afternoon. Only the update closes the flaw.

Updated on 21 October 2026, 18:30 CEST. Sources: PHP (opens in a new window) · CVE-2026-109618 (opens in a new window) · CVE-2026-109619 (opens in a new window) · NCSC (opens in a new window) · Dutch government (opens in a new window) · House of Representatives (ANP) (opens in a new window) · Cloudflare (opens in a new window)

02 Our advice

Should your website go offline?

On 21 October the Dutch NCSC said that until the update is installed, every website running PHP is presumed vulnerable. Our advice: is the update not installed yet, or are you not sure? Then take your site offline until it is.

  • Our advice

    Not updated yet? Take it offline

    The flaw works without logging in, so every site can be reached. The damage is greatest if:

    • your site has a login, for admins or for customers
    • it has forms or uploads
    • it is a webshop or takes payments
    • customer or personal data sits behind it
    • it is linked to other systems, such as your CRM or ERP
    Ask us for help
  • Updated

    Updated? Then it can stay online

    The update of 21 October closes the flaw. That is the case if:

    • your site is hosted with us: we installed the update on 21 October
    • your host or you installed PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer
    Not sure? Ask us

Sources: NCSC (opens in a new window) · PHP (opens in a new window) · Sansec (opens in a new window)

03 Your website

What does it mean for your website?

That depends on where your website runs.

  • Your website is hosted with us

    We installed the update on all our servers on 21 October. You don’t need to do anything.

    • PHP is updated on all our servers
    • Sites that were offline are back online
    • Questions? We are happy to help
    Ask your question

  • You host your website yourself

    Does your site run with another hosting provider or on your own server? Then they, or you, need to install the update of 21 October.

    • Ask your host whether the update is installed. Many large hosts said on 21 October that they update PHP themselves.
    • Running your own server? Install PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer.
    • Can’t it be done quickly? Take the site offline until then, with PHP switched off.
    • Want help? Ask us about the options.
    Ask about the options

Sources: PHP (opens in a new window) · Antagonist (opens in a new window)

04 21 October

How did it go?

For websites hosted with us.

  1. Offline on request

    If you asked, we took your website offline, with a temporary page in front.

  2. Around 16:00 CEST

    PHP released the update.

  3. Then

    We installed the update on all our servers.

  4. Back online

    Sites that were offline went back on, and we let their owners know.

Sources: PHP (opens in a new window) · ANP (Accountant.nl) (opens in a new window)

Questions we often get

How do I know whether my website runs on PHP?

Enter your address in the check at the top of this page and we will look it up. We do not keep the address. Many of the websites we built run on PHP, as does every WordPress site. Does the check say it is not sure? Ask us.

Do I need to do anything if my site is hosted with you?

No. We installed the update on all our servers on 21 October.

Does updating WordPress or my plugins help?

No. The flaw is in PHP itself, not in WordPress or a plugin. Only the PHP update fixes it.

Does Cloudflare help?

Since 21 October Cloudflare has been blocking the known attacks, on the free plan too. It is a stopgap: it only works if your server accepts no traffic that bypasses Cloudflare, and the update is still needed.

Has my website already been hacked?

On 21 October the NCSC had not confirmed any misuse. Look out for unknown files or admin accounts, strange redirects or spam sent from your site. If you see anything odd, get in touch with us.

Should I change my passwords?

Only if there are signs that your site has been misused. And never give your password to anyone who calls or emails about an ‘urgent update’.

Is taking my site offline bad for Google?

Not if it is short. For a day or two offline, Google recommends a temporary page with the error code 503, so search engines know the site will be back.

Why did big sites such as MijnOverheid go offline?

As a precaution. On 21 October the NCSC advised weighing for each system whether it should be switched off until the update, and with a lot of data that choice is quickly made.

How long will my site stay offline?

Until the update is installed and we’ve checked that everything works. On our servers the update has been in since 21 October, so sites that were offline are back online.

Sources

Contact

A question about the PHP flaw?

Put your website’s address in your message and we’ll look into it. Urgent? Call +31 85 001 4321.

A real person who helps you think it through

No account managers or middlemen. Tell us what you’re running into, and we’ll work out together what fits your situation.

That’s all we need. See also our privacy statement.

Get directions