Emergency PHP Security Flaw Prompts Global Agencies to Order Websites Offline

On Wednesday morning in The Hague, the Tweede Kamer—the lower house of the Dutch parliament—abruptly pulled its public website offline. It was not an isolated outage. Across the Netherlands, the national DigiD authentication system, the MijnOverheid citizen portal, and the National Cyber Security Centre all intentionally went dark.[1][6]

The coordinated shutdown was a drastic precautionary measure against a pair of critical vulnerabilities discovered in PHP. As the server-side programming language that powers roughly 70 percent of the internet, PHP is the foundational infrastructure for platforms ranging from WordPress and Drupal to custom enterprise applications.[2]

Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws carry a 9.2 out of 10 severity rating on the CVSS v4.0 scale. The European Union's Computer Emergency Response Team (CERT-EU) issued an advisory on Tuesday evening, warning that the bugs allow unauthenticated remote code execution.[3][4]

In practical terms, this capability means an attacker can run malicious commands on a web server without needing a password, a valid session, or any login credentials. "These vulnerabilities affect websites worldwide and make it possible to remotely control a server," a Tweede Kamer spokesperson confirmed.[1][4]

The Exploit Leak

The PHP development team originally planned a coordinated security release, but the timeline collapsed when information about the vulnerabilities leaked ahead of the embargo. A screenshot of an exploit tool named "PHP2Shell," credited to independent security researchers, began circulating on social media early in the week.[2][3]

The leaked banner claimed the tool works against every PHP release from version 5.4.0 onward. This massive backward compatibility means the flaw threatens not just modern infrastructure, but over a decade of legacy websites, abandoned applications, and unmaintained e-commerce stores.[2][3]

Forced by the leak, the PHP security team moved its emergency patch release forward by a day, scheduling it for Wednesday at 14:00 UTC. The developers warned they would publish the fix even earlier if technical details became fully public or if widespread attacks began.[3]

Security vendors quickly amplified the threat, with e-commerce security firms predicting that mass automated attacks would begin within 15 minutes of the patch's release. While vendor timelines often lean toward worst-case marketing scenarios, the underlying telemetry suggests the probing has already started.[2][6]

Early Probes and Mitigations

By early Wednesday, internet infrastructure providers reported intercepting early attacks targeting PHP sites across their networks. Companies began deploying updated firewall rules to block the malicious traffic before it could reach vulnerable origin servers.[6]

The exact mechanism of the flaw involves how PHP parses multipart/form-data request bodies—the standard format web browsers use for file uploads. Because PHP processes these requests before the actual application code runs, the vulnerability triggers before any application-level security checks can intervene.[2]

To buy time, security researchers advised administrators to block multipart/form-data requests entirely at the web server level using Nginx or Apache rules. While this temporary measure stops the exploit from reaching PHP, it intentionally breaks all file uploads, effectively crippling media libraries and product image updates.[2]

Initial mitigation advice also suggested that administrators could block the exploit by altering PHP configuration files, specifically by tweaking session upload progress settings or memory limits. However, security firms later confirmed that these configuration changes do not actually protect against the vulnerabilities.[2][3]

With no reliable configuration workaround available, the guidance from national cybersecurity agencies became unusually blunt. CERT-EU strongly recommended that organizations identify their PHP-based applications and prepare to patch immediately.[4][5]

Disconnecting the Web

"Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied," CERT-EU advised. This directive is what prompted the wave of preemptive shutdowns across European government infrastructure.[4][6]

Beyond the Dutch parliament, the preventative outages extended to the Royal Dutch Pharmacists Association, police unions, and parts of the Netherlands' shared IT network for higher education and research. Administrators calculated that a temporary outage was preferable to a full system compromise.[1]

The Dutch National Cyber Security Centre (NCSC) took its own site offline, alongside the national data protection agency. "Apply these updates immediately as soon as they become available," the NCSC urged, noting that while it had not yet detected active domestic exploitation, the risk was too severe to ignore.[1]

Web hosting providers are now bracing for the fallout. Security researchers warned WordPress users that automatic updates will not apply the core PHP fix, requiring manual server-level intervention to secure the underlying infrastructure.[2]

Global Fallout and Cleanup

The global response mirrored the European alarm. Cyber chiefs in multiple countries issued parallel guidance, advising domestic organizations to identify vulnerable PHP servers and monitor for malicious activity, acknowledging that the sheer volume of affected sites makes immediate universal patching impossible.[5]

Once the official patches are applied, the cleanup work begins. Security teams are advising administrators to check their servers for indicators of compromise dating back to at least June 2026, looking for unexpected web shells, new administrative users, or unusual outbound network connections.[2][3]

The incident highlights the fragility of the web's aging foundations. While modern development has shifted toward languages like Rust and Go, the internet remains overwhelmingly reliant on PHP, meaning a single core vulnerability can still force governments to unplug their digital front doors.[6]