PHP vulnerabilities: status and updates
During the night of 20 to 21 October 2026, details leaked of two critical vulnerabilities in PHP, the programming language that a large share of all websites runs on. We are preparing all websites for the security update, so we can install it quickly and with as little interruption as possible. We will keep you informed on this page.
ResolvedLast updated: 22 October 2026 at 10:08
Updates
Plesk control panel updates completed
The security updates for all Plesk control panels were also completed before 10:00 (CEST), and the final tests have been completed. All websites are running at their normal speed again. Is your website not working as expected? Please create a ticket via support@it-gemak.nl and our engineers will help you as quickly as possible.
Updates for the Plesk control panel in progress
This morning, security updates were also released for the Plesk control panel. Our engineers are now carrying out these updates. During the updates, websites may temporarily respond a little more slowly, as the updates use part of the available computing power. We expect to complete the updates around 10:00 (CEST). We will keep you posted here.
More background on PHP2Shell
Want to know more about the two vulnerabilities in PHP, what exactly happened and how the flaw leaked? Tweakers (in Dutch) has published a detailed overview of what is currently known about PHP2Shell: tweakers.net/reviews/15504/wat-we-nu-weten-over-php2shell-de-twee-kwetsbaarheden-in-scriptingtaal-php.html
All websites are back online
The security update has been installed and checked, and all websites are back online. Is your website not working as expected? Then it was most likely using software that only works on an outdated PHP version. No security update is available for those older versions yet, which is why all websites now run on a supported, secure PHP version. The website, for example WordPress with its plugins and themes, then needs to be updated to a version that works on a newer PHP version. After that, everything will work as you are used to again. Plesk is also working on security updates for the older PHP versions and tracks its progress at support.plesk.com/hc/en-us/articles/44397729587351. Is your website not working? Please create a ticket via support@it-gemak.nl. Our engineers are helping everyone as quickly as possible. A ticket lets them resolve the problem fastest, or let you know what needs to be done.
Websites coming back online
The security update has been installed and the websites are now coming back online one by one. We expect all websites to be available again within about 15 minutes. Our engineers will then carry out the final checks. We will keep you posted here.
Plesk has made the security update available
Plesk has made the security update for both vulnerabilities available for our web servers. For PHP 8.2, the version all websites run on, this is PHP 8.2.35. Our engineers are first installing and testing the update on a test server and preparing the rollout to the other servers. Once the test has passed, we will update the production web servers and bring the websites back online. We will keep you posted here.
PHP has released the security updates, waiting for Plesk
The PHP developers have released the security updates for both vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (source: php.net/archive/2026.php). Our web servers run on Plesk. Plesk delivers the updated PHP versions to the servers itself, and this update is not yet available for our servers. As soon as Plesk makes the update available, our engineers will install and check it straight away and bring the websites back online. Because all websites already run on PHP 8.2, no further preparation is needed. Until then, the websites will remain offline as a precaution.
Why we moved all websites to PHP 8.2 first
Immediately after the vulnerabilities became known, we moved all websites to PHP 8.2 or higher. The security update is only released for PHP 8.2 up to and including 8.5. Had we made this move only after the update was released, the websites would have remained exposed to exploitation of the flaw for longer. Because this step is already complete, we can install the update straight away and then bring the websites back online.
Information page in place on all websites
Visitors to the websites now see an information page instead of the standard error message. It explains why the website is temporarily unavailable and that it will be back once the security update has been installed and checked. Our engineers are standing by for the information on the security update that the PHP developers expect to share around 16:00 (CEST), so we can get to work straight away.
Major Dutch websites also offline as a precaution
More than two thirds of all websites worldwide (69.3%) run on PHP. It is the foundation of WordPress, Joomla, Drupal and Magento, among others. The PHP developers planned to release the security updates on Thursday, but information about the vulnerabilities leaked last night. The PHP developers will share more information at 16:00 (CEST) and expect to release the updates then. The tips circulating online to reduce the risk appear to offer insufficient protection. Besides Tweakers, RTL Nieuws, MijnOverheid, DigiD and the Dutch House of Representatives website, among others, have gone offline as a precaution.
PHP security update not yet available
The PHP developers are still working on the fix for both vulnerabilities and expect to release it around 16:00 (CEST). This has not yet been confirmed. All websites are ready on PHP 8.2, so we can install the update as soon as it is released. We will keep you posted here.
All websites now run on PHP 8.2
All websites have been updated and now run on PHP 8.2. They are ready for the PHP security update, which is expected around 16:00 (CEST). Our engineers are carrying out the final checks. We are also preparing a temporary page that visitors will see while a website is unavailable during the update.
Snapshots taken, websites being prepared for PHP 8.2
We have taken snapshots (full backups) of all web servers. We are now preparing all websites for PHP 8.2, so that we can install the PHP security update, expected around 16:00 (CEST) today, straight away. The websites are online; a website may be briefly unavailable during the work.
What is going on?
The issue concerns CVE-2026-109618 and CVE-2026-109619, two flaws in PHP itself. The PHP security team rates both as critical (CVSS 9.2).
Through the flaws, attackers can publish their own web pages and possibly spread malware; the so-called PHP2Shell exploit would also make it possible to run their own code on the server. This affects every website or web application on PHP, such as WordPress, WooCommerce and Magento, however well secured it is itself.
What are we doing?
- We have taken snapshots (full backups) of all web servers.
- We are preparing all websites for PHP 8.2. The PHP developers only release a security update for PHP 8.2 up to and including 8.5; older versions officially no longer receive updates. This step lets us install the update on every website.
- The PHP developers are still working on the security update and expect to release it on 21 October 2026 around 16:00 (CEST). That update is the only real fix. Because the websites will be ready by then, we will install it straight away, server by server, and keep the interruption as short as possible.
- Until the update is available, we are disabling PHP on the web servers so the flaws cannot be exploited. During this period, visitors will see a temporary information page.
- After the update, we will check each website to confirm the flaws are closed and everything works properly, and bring the website back online.
What does this mean for you?
Your website stayed online during the move to PHP 8.2. While PHP is disabled, your website is unavailable and visitors will see an information page. As soon as the security update has been installed and checked, your website will be back online.
If something goes wrong during the work, we will restore the snapshot. Your website will then be back as it was when the snapshot was taken; changes made after that, such as new posts, orders or form submissions, may be lost. We therefore recommend postponing major changes to your website until the work is complete.
We will post every step below.
Questions? Call our service desk on 030 73 70 836 or email info@it-gemak.nl.
You are not alone
Almost 70% of all websites worldwide (69.3%) run on PHP, from small business sites to large online stores. These vulnerabilities therefore affect websites all over the world, and hosting providers and administrators everywhere are working on the same update today.
Why is it-gemak.nl still available?
Our own website is built with Node.js and does not use PHP. These vulnerabilities are in PHP itself, so it-gemak.nl is not affected and remains available.
Sources: PHP, Sansec, Patchstack, W3Techs