Overview
- Developers disclosed two critical remote‑code execution vulnerabilities in the PHP programming language that underpin roughly 70% of websites, creating an urgent risk that attackers could fully control vulnerable servers.
- After the vulnerabilities became public on Wednesday, many organisations including NotuBiz, dozens of municipalities, hospitals, universities and media groups took websites or subsystems offline as a short‑term measure to prevent intrusions.
- PHP maintainers published a security update around 16:00 on Wednesday and administrators began installing the patch, with some high‑profile sites and apps already coming back online while others remain offline pending verification.
- Official bodies including the PHP Foundation and the Dutch NCSC say they have no confirmed large‑scale breaches in the Netherlands so far, even as vendors such as Cloudflare reported early exploit attempts and continued network monitoring.
- The takedowns disrupted public services such as council information systems, livestreams, ticketing and some patient‑facing functions and exposed how reliance on single suppliers like NotuBiz can magnify outages while organisations complete fixes and recheck security.