{"id":1456,"date":"2026-10-21T14:32:25","date_gmt":"2026-10-21T12:32:25","guid":{"rendered":"https:\/\/freshdev.fresh-dev.site\/blog\/beveiligingsupdate-php-oktober-2026\/"},"modified":"2026-10-22T06:22:15","modified_gmt":"2026-10-22T04:22:15","slug":"beveiligingsupdate-php-oktober-2026","status":"publish","type":"blog","link":"https:\/\/freshdev.fresh-dev.site\/en\/blog\/beveiligingsupdate-php-oktober-2026\/","title":{"rendered":"PHP bug critique (October 2026): resolved"},"content":{"rendered":"
\n
\n
\n

Resolved: all websites are back online<\/h2>\n

The security update for PHP has been installed on all our servers, and we have checked on each server to ensure that the websites are working properly. Since the early morning of October 22nd, all websites have been back online.<\/p>\n

No hack has taken place on our servers.<\/strong>, and we have found no indications of abuse.<\/p>\n <\/div>\n

\n

What was going on<\/h2>\n

PHP is the programming language on which, among other things, WordPress runs. Globally, about 70 percent of all websites use PHP. Researchers found two serious vulnerabilities (CVE-2026-109618<\/a> and CVE-2026-109619<\/a>). This allowed someone to execute code remotely on a web server, without logging in.<\/p>\n

Normally, such an update goes smoothly: the PHP team fixes the problem, shares it in advance with the server software vendors, and at a scheduled time everything comes out at the same time. This time that didn\u2019t happen. One of the discoverers published a video with details too early, and another company released the repaired version six hours before the scheduled time. As a result, the information was already public while most vendors had not yet finished their updates. Organizations around the world took precautions by taking their websites offline, including DigiD, the Tweede Kamer, and Tweakers.<\/p>\n <\/div>\n

\n

Why we went offline, and why it lasted into the night<\/h2>\n

On October 21st, we first did everything to keep the websites online safely: extra monitoring, blocking of the known attack patterns, and migrating websites to a newer PHP version. When it became clear how great the risk was, we decided to temporarily take the servers offline.<\/p>\n

PHP released the update at 16:00. Our servers are running on CloudLinux, an operating system specifically designed for web servers that run many websites side by side. CloudLinux provides its own PHP versions, and those had to process the update first. At 21:00, CloudLinux reported that the update was ready, but later that evening it turned out that it was not yet valid for the version our servers were using. The correct packages only became available after midnight. We deliberately waited until everything was updated, rather than going online with a half-baked solution earlier.<\/p>\n <\/div>\n

\n

Timeline<\/h2>\n