Overview
- CERT-EU alerted organisations to two critical PHP vulnerabilities that can let an attacker run code on a remote server, prompting urgent defensive action.
- PHP developers scheduled a security patch for 16:00 CET on Wednesday and told administrators to install it immediately or isolate public-facing services until they could update.
- Dozens of municipal, provincial, healthcare, education and media sites — including many raadsinformatiesystemen served by NotuBiz — were deliberately taken offline as a precaution while teams applied fixes.
- Cloudflare reported initial exploit attempts and implemented emergency firewall rules, while the PHP Foundation and the Dutch NCSC said they had not seen confirmed large-scale intrusions in the Netherlands so far.
- Because roughly 70 percent of websites run on PHP, the flaw can affect many services at once and restoration times vary by PHP version, hosting setup and third-party software, so expect continued partial outages and staggered returns as patches are applied and tested.