On 20 October 2026, the PHP security team announced two critical vulnerabilities in PHP, the language behind WordPress, Joomla, Drupal and Magento, among others. The flaws may let an attacker run code on a server without logging in. In the Netherlands, DigiD, MijnOverheid and the Dutch House of Representatives were among the sites taken offline as a precaution on 21 October. PHP ships the security update on 21 October at 14:00 UTC.
What is happening with PHP?
PHP2Shell is the name for two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both 9.2 on the CVSS scale (version 4.0), and according to CERT-EU that points to remote code execution without authentication. What makes these flaws unusual is the order of events. Details leaked before a fix existed, while a flaw like this normally becomes public together with the update. On 20 October, PHP therefore announced an out-of-band security release on php.net for Wednesday 21 October at 14:00 UTC. PHP will only publish the exact affected versions with that release. Reports that every version since PHP 5 is vulnerable had not been confirmed by PHP at the time of writing. What is certain is that only the supported branches, PHP 8.2 to 8.5, will receive an update. Older versions get no fix.
Which websites went offline in the Netherlands?
On 21 October 2026, a range of Dutch organisations took their websites offline as a precaution, according to NOS, including MijnOverheid, DigiD and the House of Representatives. The site and app of RTL Nieuws, Tweakers, the National Cyber Security Centre (NCSC) and the Dutch Data Protection Authority went offline too. Notubiz, the meeting system used by about 100 municipalities, was switched off as well, along with systems in higher education and at news agency ANP. The NCSC put it this way: until the update is installed, every system that contains PHP and is reachable from the public internet is presumably vulnerable. One point matters here: most of these sites were not hacked. They were taken offline on purpose, because disconnecting is the only guaranteed protection until an update exists. That is a sensible choice, but an expensive one for organisations that depend on their site.
Is the PHP vulnerability already being exploited?
Reports on exploitation differ, and as of midday on 21 October 2026, large-scale exploitation was not confirmed. The NCSC had not yet seen active exploitation, and security firm Huntress reported the same for its partner environments. According to The Hacker News, the flaws were not yet in the US CISA catalogue of actively exploited vulnerabilities either. At the same time, Cloudflare says it sees the first attacks, which it says its firewall blocks, and Patchstack reports signs of exploitation from several hosting partners. Security firm Sansec expects mass attacks shortly after the technical details become fully public. For a website owner that means: assume a real risk, even if your site still works normally. A flaw rated 9.2 that has already partly leaked is usually exploited quickly once someone shares working attack code. So do not wait for exploitation to make the news.
Is your website affected by the PHP vulnerability?
Your website may be affected if it runs on PHP, which covers a large part of the web: according to BNR, the flaws affect about 70% of all websites. PHP sits under 1) WordPress and WooCommerce, 2) Joomla, Drupal and Magento, and 3) much custom work on Laravel or Symfony. A simple site at a web host often runs on PHP without the owner knowing. You can check in three steps. First, look up the PHP version in your hosting control panel, or ask your hosting provider. Second, check whether your site uses a CMS; if "/wp-admin" after your domain opens a login page, it is WordPress. Third, if your site runs an old PHP version such as 7.4 or 5.6, no update is coming and you need to upgrade or migrate. A site built with Next.js, another JavaScript framework or as a static site does not run on PHP and falls outside these two flaws.
What should you do now if your site runs on PHP?
If your site runs on PHP, update PHP as soon as possible after the release on 21 October 2026 at 14:00 UTC, and reduce the risk until then. Step 1: ask your hosting provider whether they update PHP themselves; with managed hosting this often happens automatically. Step 2: if you run your own server, install the new PHP version as soon as php.net publishes it. Linux distributions sometimes apply the fix without changing the version number, so check your distribution's security advisory. Step 3: if you run an unsupported PHP version, plan an upgrade to PHP 8.2 or newer right away. Step 4: until the update, put a web application firewall such as Cloudflare's in front of your site, or switch the site to maintenance mode if it handles sensitive data. Step 5: after updating, check your logs and the files on the server for unknown scripts. Then update WordPress, themes and plugins too.
Do VirtuoLab websites run on PHP?
Websites and web apps that VirtuoLab builds with Next.js do not run on PHP, so CVE-2026-109618 and CVE-2026-109619 do not affect them. virtuolab.dev itself runs on Next.js 16 with Node.js and stayed online on 21 October. To be fair, VirtuoLab also builds WordPress and WooCommerce plugins, and those run on the client's PHP server. If you have such a plugin, the plugin itself is not the problem, but the PHP version on your hosting must be updated, and VirtuoLab is happy to help with that. To be equally fair: no technology is immune. In December 2025, React, the foundation of Next.js, had its own critical flaw (CVE-2025-55182, rated 10.0), which was patched within days. The difference lies in two things: 1) how few parts are exposed to the internet, and 2) how quickly you update. A custom site without third-party plugins has fewer open doors.
Should you switch from WordPress to Next.js now?
No, a flaw in PHP is not in itself a reason to switch in a panic; the first step is always to update. WordPress powers a large part of the web and receives updates quickly, and for a team that works with it every day it remains a good choice. Moving to a custom site built with Next.js is worth considering if 1) your site has many plugins you do not maintain yourself, 2) your site matters for revenue and a day offline costs a lot, or 3) your hosting provider is slow to update PHP. According to Patchstack, 91% of WordPress vulnerabilities in 2025 were in plugins, not in WordPress itself. A custom site has fewer of those separate parts. At VirtuoLab, a business website in Next.js starts at €2,000 and a web app at €5,000, with a fixed price upfront. If you are unsure what fits best, you will hear it honestly in a free intro call, even if the advice is to stay with WordPress.
Need help?
Not sure whether your website runs on PHP, or want to know what to do now? Book a free intro call with VirtuoLab. You talk directly to the developer himself, Mustafa Kose: call +31 6 43913632 or email info@virtuolab.dev. Together we check which technology your site uses, whether anything needs to happen, and how to make your site less vulnerable afterwards.