Critical PHP flaws take Dutch council sites offline as a precaution

What happened

On Wednesday, 21 October 2026, NotuBiz, the platform that lets Dutch public bodies share official information with council and provincial members, took its services offline as a precaution. The company says it has found no sign of a security breach. Around a hundred municipalities, provinces and water boards use the system, including The Hague, Almere, Breda, Haarlem, Delft, Overijssel, Gelderland and Friesland. In Fryslân, the province, Wetterskip Fryslân and the municipalities of Smallingerland and Súdwest-Fryslân rely on it too. In the province of Utrecht, the council information systems of eleven municipalities, among them Amersfoort, Zeist and IJsselstein, went dark, and NotuBiz does not yet know when they will be back. News agency ANP has also shut down its own systems as a precaution.

Two critical flaws in PHP

CERT-EU, the cybersecurity service of the European Union, warned on Wednesday morning about two vulnerabilities in PHP that it describes as critical. The flaws score 9.2 out of 10 on the CVSS scale, which measures how easily a weakness can be exploited and how widely it applies. They have been named CVE-2026-109618 and CVE-2026-109619. The PHP maintainers reported the two flaws the same morning, and they could let an attacker take control of a server from a distance. Reports put the share of websites that run PHP or applications built on it at about 70 percent worldwide.

Cloudflare, a US company whose firewall protects many popular websites, reports first attacks and says its firewall is catching attempts to exploit the flaw. Hackers appear to have found a way to misuse the problem before a fix is available. Cybersecurity firm Huntress wrote on its website about how widespread PHP is:

“PHP is everywhere. It runs unseen under WordPress, Drupal, Joomla and Magento sites.”

Warnings and the 16:00 update

The existence of the flaws leaked on Tuesday, 20 October, and a video circulating on social media reportedly shows how they can be exploited within seconds. Ethical hacker Inti De Ceukelaire described the problem as very serious and said he feared a wave of hacking incidents:

“I fear this is going to be a shitshow.”

According to De Ceukelaire, attackers could add files and read source code and security keys, and those keys could open access to a customer database. He added that many companies may still run PHP without knowing it, on older blogs or websites. Wouter van Dongen, another ethical hacker, told ANP that the danger is that sites get taken over or that someone can reach all their data. He was not surprised by the first attacks:

“Hacker groups are going all out on this.”

Update and advice

The PHP security team plans to release its update at 16:00 Dutch time and says it may release it earlier if details of one of the flaws become public or if it finds evidence of active exploitation. CERT-EU urges organisations to prepare to install the updates immediately. Organisations that cannot update in time should consider taking their sites offline, the agency said. The chart below sets out the moments reported so far.