writer Clarence | by AfterPost | 21 October 26
Yes, it's true. On Oct 21, 2026, government websites in the Netherlands and Finland were taken offline after two critical PHP flaws were disclosed. The Dutch National Cyber Security Centre (NCSC) pulled its own website as precaution, along with DigiD, MijnOverheid, Tweede Kamer parliament, Port of Rotterdam, http://Overheid.nl, KNVB, and hospital sites. Finland's state IT center Valtori shut all public-facing government services. Agencies in UK, EU, Australia, US NSA urged patch or go offline.
One software flaw was enough to spook multiple governments off the web. It’s that simple - and that serious.
What happened:
PHP developers announced Tuesday Oct 20 that two critical vulnerabilities existed and patch would come Wednesday 14:00 GMT. But details leaked early on Hacker News and social media. Tool called PHP2Shell surfaced. Cloudflare CTO Dane Knecht confirmed: "We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as PHP releases the update."
Faced with zero-day in wild and no patch yet, governments chose to go dark.
The flaw - PHP2Shell:
- CVEs:
CVE-2026-109618 and CVE-2026-109619- Severity:
CVSS v4.0 9.2 - Critical- Type:
Unauthenticated Remote Code Execution (RCE) - no login needed- Affects:
All PHP since 5.4, but officially patched in 8.5.12, 8.4.27, 8.3.36, 8.2.35 released Oct 21- Why scary:
PHP powers 70% of sites with known language per W3Techs. WordPress powers 40% of all websites. WordPress, Drupal, Joomla, Magento all run on PHP. Wordfence warns WordPress auto-updates will NOT fix PHP - host must patch.Discovered by Wiz Research using Gemini 4 Argon on Aug 19, reported Aug 24, but embargo broke Oct 20. Found with AI.
Who went offline - confirmed list:
Netherlands - most hit:
Dutch NCSC, National Institute for Public Health and Environment (RIVM), DigiD login service, MijnOverheid citizen portal, Tweede Kamer (House of Representatives), http://Overheid.nl, Port of Rotterdam, Dutch Data Protection Authority, 5 largest political parties, several hospitals, NotuBiz municipal portals - Amsterdam, Den Bosch, Breda, Tilburg, Helmond, etc., SURF university network, ANP news agency, RTL Nieuws, Tweakers tech site.Finland:
Valtori - state IT provider took all government public network services offline as precautionary measure. Said no exploitation detected, no breach.Other countries:
France Interior Ministry - prefectures and Paris Police Prefecture offline, Germany ITZBund - federal sites offline, Denmark Kombit - school communication platform offline, Belgium Foreign Ministry - websites offline, UK councils and Met Police among sites pulled after UK NCSC alert, Wikimedia Foundation - number of systems taken down.What agencies said:
CERT-EU: "Organizations unable to apply fixes should consider taking affected sites offline." Risk is unauthenticated RCE.
UK NCSC: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated."
US NSA: Flaws provide "direct path to server's file system or database." Take systems offline if can't update.
Australian Cyber Security Centre, Japan, all similar.
Why NCSC pulled its own site - precedent:
Dutch NCSC statement: "As long as that does not happen, any system that contains PHP and is reachable from the public internet is probably vulnerable" and "very high risk of complete takeover of the system by external attackers." Pulling own site signals seriousness - even defenders vulnerable.
What to do now:
Patch is live since 14:00 GMT Oct 21. Update to 8.5.12, 8.4.27, 8.3.36, 8.2.35 immediately. Cloudflare WAF is stopgap only. If you can't patch, take offline per NCSC guidance. Check hosting provider - not your CMS.
FAQ
Are Netherlands and Finland government sites really offline?
Yes, verified Oct 21, 2026 by Reuters and Bloomberg. Netherlands took dozens of sites offline including NCSC, DigiD, parliament. Finland's Valtori took all public-facing government services offline as precaution. No breaches confirmed - preventive.What is PHP2Shell?
Two critical memory-safety flaws in PHP core engine, CVE-2026-109618 and CVE-2026-109619, CVSS 9.2. Allows attacker to force out-of-memory error, leak memory, then run arbitrary code without login. Nickname because it gives attacker shell.Is the Dutch cybersecurity agency website offline?
Yes. Nationaal Cyber Security Centrum (NCSC) temporarily took its own site offline Oct 21 as precaution, confirmed by NOS public broadcaster.How dangerous is this PHP flaw?
Extremely. 70% of websites use PHP. WordPress alone is 40% of web. Cloudflare seeing early active exploitation. NSA says direct path to file system/database. Wiz says vulnerability existed for over a decade.Has anyone been hacked?
As of Oct 21 afternoon, ACSC Australia said not aware of active exploitation, Finland said no exploitation detected, Germany said no incidents known. But Cloudflare and Patchstack confirmed early attacks emerging in wild after leak.Also read this: https://afterpostint.com/post/h2-strong-wiz-gemini-4-argon-finds-2x-more-bugs-catches-critical-flaw-strong-h2