Critical PHP Security Updates Released as Dutch Websites Prepare to Return Online

Developers of the widely used PHP programming language have released two emergency security patches after critical vulnerabilities forced several websites in the Netherlands to temporarily shut down.

The updates were released on Wednesday, October 21, 2026, at approximately 4 p.m., following warnings that the security flaws could allow cybercriminals to remotely gain control of vulnerable websites and potentially their servers.

The Dutch National Cyber Security Centre (NCSC) warned that although the fixes are now available, some affected websites may need several hours or longer before they can safely resume operations.

Several websites across the Netherlands were temporarily taken offline on Wednesday as organizations took precautions against potential cyberattacks.

Among those affected was NL Times, which also temporarily suspended access to its website.

According to the NCSC, the time required to restore affected websites will depend on the PHP versions they use and the complexity of their systems.

Some websites may be able to install the updates and return online within minutes, while others could require hours or additional technical work.

“Some websites can flip a switch, but for others it may take longer. Depending on which version they are using,” NCSC Deputy Director Corine Schipper-Derkse said during a press briefing.

She stressed that installing the security updates was essential to prevent attackers from exploiting the vulnerabilities.

The NCSC, which operates under the Dutch Ministry of Justice and Security, has advised organizations to install the patches as soon as possible.

Schipper-Derkse said businesses and website operators must assess their own security risks and decide whether temporarily shutting down vulnerable systems is necessary.

“It is up to organizations themselves to assess the risks and take the systems offline if necessary,” she explained.

The agency also warned that additional security patches could become necessary if the initial updates fail to resolve all the identified problems.

The cybersecurity concerns intensified after information about the vulnerabilities became public before developers had completed the necessary fixes.

According to Schipper-Derkse, details of the security weaknesses were leaked, increasing the urgency for organizations to protect their systems.

“The moment you become aware of a vulnerability, you want to wait until the patch is ready before it becomes public. That was not the case,” she said.

The premature disclosure meant attackers could potentially learn about the weaknesses before organizations had an opportunity to secure their websites.

As a result, some companies and institutions decided to temporarily suspend their online services rather than risk an attack.

Despite the widespread concern, the NCSC said there was no indication of panic among Dutch organizations or the public.

Schipper-Derkse praised major organizations for responding cautiously and taking preventive measures.

She also confirmed that cybersecurity authorities in other European countries were addressing the same vulnerabilities.

The security flaws may have existed in PHP software for a considerable period before being identified.

According to the NCSC, this highlights the importance of regular security checks and software updates, similar to the updates commonly installed on smartphones and computers.

With the emergency patches now available, organizations are expected to begin restoring websites after installing the updates and completing necessary security checks.

However, the NCSC has emphasized that website operators remain responsible for assessing their exposure and ensuring their systems are properly protected.

The incident highlights the potential disruption caused by vulnerabilities in widely used internet technologies and the importance of responding quickly to cybersecurity threats.

Help ibynews grow,stay free & keep independent journalism alive