PHP vulnerabilities: status and updates
During the night of 20 to 21 October 2026, details leaked of two critical vulnerabilities in PHP, the programming language that a large share of all websites runs on. We are preparing all websites for the security update, so we can install it quickly and with as little interruption as possible. We will keep you informed on this page.
Mitigation in placeLast updated: 21 October 2026 at 17:17
Updates
Plesk has made the security update available
Plesk has made the security update for both vulnerabilities available for our web servers. For PHP 8.2, the version all websites run on, this is PHP 8.2.35. Our engineers are first installing and testing the update on a test server and preparing the rollout to the other servers. Once the test has passed, we will update the production web servers and bring the websites back online. We will keep you posted here.
PHP has released the security updates, waiting for Plesk
The PHP developers have released the security updates for both vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net/archive/2026.php). Our web servers run on Plesk. Plesk delivers the updated PHP versions to the servers itself, and this update is not yet available for our servers. As soon as Plesk makes the update available, our engineers will install and check it straight away and bring the websites back online. Because all websites already run on PHP 8.2, no further preparation is needed. Until then, the websites will remain offline as a precaution.
Why we moved all websites to PHP 8.2 first
Immediately after the vulnerabilities became known, we moved all websites to PHP 8.2 or higher. The security update is only released for PHP 8.2 up to and including 8.5. Had we made this move only after the update was released, the websites would have remained exposed to exploitation of the flaw for longer. Because this step is already complete, we can install the update straight away and then bring the websites back online.
Information page in place on all websites
Visitors to the websites now see an information page instead of the standard error message. It explains why the website is temporarily unavailable and that it will be back once the security update has been installed and checked. Our engineers are standing by for the information on the security update that the PHP developers expect to share around 16:00 (CEST), so we can get to work straight away.
Major Dutch websites also offline as a precaution
More than two thirds of all websites worldwide (69.3%) run on PHP. It is the foundation of WordPress, Joomla, Drupal and Magento, among others. The PHP developers planned to release the security updates on Thursday, but information about the vulnerabilities leaked last night. The PHP developers will share more information at 16:00 (CEST) and expect to release the updates then. The tips circulating online to reduce the risk appear to offer insufficient protection. Besides Tweakers, RTL Nieuws, MijnOverheid, DigiD and the Dutch House of Representatives website, among others, have gone offline as a precaution.
PHP security update not yet available
The PHP developers are still working on the fix for both vulnerabilities and expect to release it around 16:00 (CEST). This has not yet been confirmed. All websites are ready on PHP 8.2, so we can install the update as soon as it is released. We will keep you posted here.
All websites now run on PHP 8.2
All websites have been updated and now run on PHP 8.2. They are ready for the PHP security update, which is expected around 16:00 (CEST). Our engineers are carrying out the final checks. We are also preparing a temporary page that visitors will see while a website is unavailable during the update.
Snapshots taken, websites being prepared for PHP 8.2
We have taken snapshots (full backups) of all web servers. We are now preparing all websites for PHP 8.2, so that we can install the PHP security update, expected around 16:00 (CEST) today, straight away. The websites are online; a website may be briefly unavailable during the work.
What is going on?
The issue concerns CVE-2026-109618 and CVE-2026-109619, two flaws in PHP itself. The PHP security team rates both as critical (CVSS 9.2).
Through the flaws, attackers can publish their own web pages and possibly spread malware; the so-called PHP2Shell exploit would also make it possible to run their own code on the server. This affects every website or web application on PHP, such as WordPress, WooCommerce and Magento, however well secured it is itself.
What are we doing?
- We have taken snapshots (full backups) of all web servers.
- We are preparing all websites for PHP 8.2. The PHP developers only release a security update for PHP 8.2 up to and including 8.5; older versions officially no longer receive updates. This step lets us install the update on every website.
- The PHP developers are still working on the security update and expect to release it on 21 October 2026 around 16:00 (CEST). That update is the only real fix. Because the websites will be ready by then, we will install it straight away, server by server, and keep the interruption as short as possible.
- Until the update is available, we are disabling PHP on the web servers so the flaws cannot be exploited. During this period, visitors will see a temporary information page.
- After the update, we will check each website to confirm the flaws are closed and everything works properly, and bring the website back online.
What does this mean for you?
Your website stayed online during the move to PHP 8.2. While PHP is disabled, your website is unavailable and visitors will see an information page. As soon as the security update has been installed and checked, your website will be back online.
If something goes wrong during the work, we will restore the snapshot. Your website will then be back as it was when the snapshot was taken; changes made after that, such as new posts, orders or form submissions, may be lost. We therefore recommend postponing major changes to your website until the work is complete.
We will post every step below.
Questions? Call our service desk on 030 73 70 836 or email info@it-gemak.nl.
You are not alone
Almost 70% of all websites worldwide (69.3%) run on PHP, from small business sites to large online stores. These vulnerabilities therefore affect websites all over the world, and hosting providers and administrators everywhere are working on the same update today.
Why is it-gemak.nl still available?
Our own website is built with Node.js and does not use PHP. These vulnerabilities are in PHP itself, so it-gemak.nl is not affected and remains available.
Sources: PHP, Sansec, Patchstack, W3Techs