Critical PHP flaws take Dutch government websites offline
DigiD, Parliament and several Dutch news outlets went dark before the patch. PHP has released fixed versions for four branches.
Several Dutch government websites went offline Wednesday as a precaution against two critical PHP vulnerabilities. PHP is the language behind much of the internet. The sites include DigiD, the citizen login for public services; MijnOverheid.nl; and the websites of the lower house of Parliament and the data protection authority.
The site of the National Cyber Security Centre (NCSC) itself also went dark, as did news outlets such as RTL Nieuws and Tweakers, and Notubiz, the platform about a hundred municipalities use for their meetings. The Dutch press has more detail on the affected sites. Some higher-education systems were also shut off, though it is not clear which.
A patch exists. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, one for each supported branch, and the project rated both flaws 9.2 out of 10 on the CVSS v4.0 scale.
What is known about the flaws
- CVE-2026-109618: faulty handling of low memory leaves request data half-initialized and can lead to remote code execution.
- CVE-2026-109619: an internal state survives being freed and is reused by a later request in the same process.
Both affect PHP installations that serve web requests, whether through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. Branches 8.1 and earlier no longer get updates from the project: PHP offers source patches for 7.4, 8.0 and 8.1, and Linux distributions may package their own. The configuration measures the project suggests only reduce exposure; the full fix is to update.
Why the sites went dark
The NCSC had seen no active exploitation so far and urged everyone to update as soon as possible. Until then, "any system running PHP and reachable from the internet is presumably vulnerable," the center warned. Cloudflare said it is already detecting the first attack attempts and that its firewall blocks them, though that protection is not foolproof.
Taking a site offline until it is patched is a cautious decision by the Dutch authorities, not confirmation that anyone has broken in.
What site owners should do
WordPress and many business, government and media systems run on PHP. Anyone who runs their own site, online store or blog should check their PHP version and update to one of the four fixed releases, or press their hosting provider for the patch if the installed branch is no longer supported. For ordinary users, the likely effect is portals that are down or in maintenance for a few hours.
