Two critical security vulnerabilities have been announced in PHP, a technology used to run many websites. Since yesterday evening, our teams have been working with our hosting and cybersecurity partners to assess the risks, prepare interventions and inform you of any potential consequences for your website.
Follow the latest developments
This live update page presents verified information, progress on interventions and decisions taken with our hosting and cybersecurity partners.
Timestamped updates appear from newest to oldest. Publications without a specified time are grouped by date. All times are Belgian time.
| Date | Time | Information and sources |
|---|---|---|
| 21/10/2026 | 20:20 | L-Post - The potential consequences for Belgian businesses. L-Post reports on the critical PHP vulnerabilities, the precautionary suspension of certain services and the release of security updates. Nicolas Pourbaix, CEO of e-net group, shares his perspective on the risks to Belgian businesses, particularly when their website uses an older version of PHP. Read the L-Post article. |
| 21/10/2026 | 20:06 | PHP2Shell - Exploitation attempts have been reported, with no consolidated assessment of compromises. watchTowr says it has detected exploitation on its network of decoy servers. Researchers have also demonstrated during tests that certain vulnerable installations can be taken over. At this stage, the sources consulted do not provide a reliable count of websites actually hacked, in Belgium or worldwide. The absence of a public assessment does not mean there have been no compromises: checks and the application of security updates remain priorities |
| 21/10/2026 | 19:11 | e-net. - Security work continues into the evening. Our teams remain mobilised alongside our hosting and cybersecurity partners. Work focuses on applying patches to compatible environments and finding suitable solutions for older versions. Interventions require technical and functional checks. Affected clients will be informed individually of the decisions and next steps for their website. |
| 21/10/2026 | 18:50 | SecurityWeek - Cybersecurity - Exploitation attempts observed after the patches were released. SecurityWeek reports that watchTowr detected exploitation attempts on its sensors around the release of the updates. According to the statement cited, no successful attempt had been observed there at that stage. These observations reinforce the urgency of updating; they do not establish that e-net. websites have been compromised. |
| 21/10/2026 | 18:10 | Washington Post - Research - The role of artificial intelligence in discovering the vulnerabilities becomes clearer. The Washington Post reports that researchers used AI tools to identify the PHP2Shell vulnerabilities. The researchers also describe their approach in a dedicated publication. The use of AI to research vulnerabilities does not demonstrate its use in attacks against the websites concerned. |
| 21/10/2026 | 18:05 | Mijndomein - Netherlands - A hosting provider announces a gradual restoration of websites. Mijndomein says it has deployed the new PHP versions across all its Plesk servers and is beginning to make its clients’ websites accessible again. This announcement concerns its own infrastructure and does not indicate progress at other hosting providers or at e-net. |
| 21/10/2026 | 17:57 | BX1 - Several Belgian public services temporarily offline. BX1 reports disruptions affecting platforms including those of Foreign Affairs, the Federal Public Service Finance and the Federal Public Service Employment, as well as partial maintenance of the website of the Brussels Region, in the context of the critical PHP vulnerabilities. MyMinfin remains available, according to the article. These disruptions do not, in themselves, constitute evidence of hacking. |
| 21/10/2026 | 17:00 | RTBF - VivaCité: e-net. contribution to the radio news bulletin. e-net. contributes to the 17:00 news bulletin on VivaCité about the PHP security alert and its potential consequences for websites. Listen again to the news bulletin on RTBF Auvio. |
| 21/10/2026 | 15:52 | e-net. - Work on patches and research into additional solutions. Our teams are working with our partners to integrate the patched versions PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 into the environments concerned. At the same time, they are looking for solutions applicable to websites using older versions. The availability of a patch does not mean it has already been installed and validated on every website. |
| 21/10/2026 | 15:48 | PHP - Official release of the security patches. The PHP team announces the availability of versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, which fix the two critical vulnerabilities. It recommends immediately updating affected installations. The availability of patches does not mean they have already been deployed on all websites. Their application must be followed by technical and functional checks. For temporarily suspended websites, restoration will depend on their environment being effectively secured. |
| 21/10/2026 | 15:26 | ANP - Hospital web services temporarily unavailable. An ANP news report states that the websites of UZA and AZ Monica in Antwerp, were temporarily taken offline in the context of the PHP alert. At UZ Leuven, the homepage remains accessible, but some forms are unavailable. These web service disruptions do not confirm either hacking or an interruption of care. |
| 21/10/2026 | 15:20 | e-net. - Coordinating interventions and preparing checks. Our teams are preparing the security steps and post-intervention functional checks with our hosting partners. Any preventive suspensions will be assessed according to the identified risk and the protection available. Clients whose websites require a specific measure will be informed individually. |
| 21/10/2026 | 15:08 | e-net. - Targeted information for potentially affected clients. Analyses carried out with our hosting and cybersecurity partners indicate a significant risk for certain configurations. Affected clients have received a communication informing them that a preventive suspension of their website could be decided from 15:30 if no adequate fix or protection can be validated. Our teams continue to research and check solutions. The decision and next steps will be communicated individually once validated. In the event of a suspension, restoration will depend on implementing and verifying a suitable solution. No general suspension of websites has been announced. |
| 21/10/2026 | 14:30 | e-net. - Refining the risk assessment. Our teams are comparing newly available information with the PHP versions and configurations of the websites we manage. This analysis, carried out with our technical partners, helps prioritise interventions and assess any protective measures needed for each environment. |
| 21/10/2026 | 14:25 | WELT / dpa - Germany - Municipal services suspended as a precaution. A dpa news agency report carried by WELT states that the city of Mainz temporarily disabled its internet portal and several online municipal services following a security alert. Administrative services remain reachable by telephone and email; scheduled appointments are maintained. |
| 21/10/2026 | 14:20 | ANP, via Welingelichte Kringen - Netherlands - Several hospitals interrupt certain online services. The ANP news agency reports that the websites of several institutions, including Maastricht UMC+ and Jeroen Bosch Ziekenhuis, are unavailable in the context of the PHP alert. Bravis hospital confirms it has placed its systems in maintenance as a precaution against PHP2Shell. Other institutions report interruptions to specific digital services. This information concerns online services and does not establish that patient care has been interrupted. |
| 21/10/2026 | 14:12 | PHP - No malicious exploitation confirmed according to the project team. The PHP team states that, at this time, it has no evidence confirming that cybercriminals have exploited the two vulnerabilities. This statement does not rule out exploitation attempts and does not change the need to prepare fixes. |
| 21/10/2026 | 14:09 | Roularta Media Group - Online service interruptions reported. Interruptions are reported at the Belgian media group, whose publications include Knack and De Zondag, in the context of the PHP2Shell alert. These outages do not, on their own, constitute proof of a compromise. |
| 21/10/2026 | 14:03 | Smartschool - Preventive suspension of the platform. The Belgian school platform is temporarily inaccessible as a precaution against the PHP vulnerabilities. It says it is working to restore its services as quickly as possible. |
| 21/10/2026 | 14:02 | AZ Monica - Website taken offline as a precaution. The Antwerp hospital temporarily disabled its website following alerts about the two critical PHP vulnerabilities. This measure aims to limit its exposure to risk. |
| 21/10/2026 | 13:20 | e-net. - Informing clients and opening the update page. An email is sent to our clients to explain the PHP alert, our response and any potential preventive measures. It invites them to consult this update page to follow verified information and decisions taken. Clients whose websites require a specific measure will also be informed individually. |
| 21/10/2026 | 13:13 | Centre for Cybersecurity Belgium - No attacks observed at this time, according to statements reported by HLN. The CCB says it has not observed attacks targeting Belgian websites. Several organisations are nevertheless taking preventive measures, including temporarily suspending their services. |
| 21/10/2026 | 13:10 | DPG Media - Preventive suspension of several websites. According to an ANP report, a spokesperson for the group confirms that several websites were temporarily taken offline as a precaution because of the PHP vulnerabilities. RTL.nl in the Netherlands and the RTL Nieuws app are explicitly mentioned. The suspensions occurred in the early afternoon. The information consulted does not specify the full list of affected websites. |
| 21/10/2026 | 12:22 | e-net. - Sharing information on our social media. A post on our LinkedIn and Facebook pages announces our response and the opening of this update page. It invites clients to consult verified information and decisions taken on our website. |
| 21/10/2026 | 12:00 | e-net. - Response and checks underway. Our teams are working with our hosting and cybersecurity partners to identify potentially affected configurations and prepare security solutions. Preventive suspension remains a possibility for websites presenting a significant risk without sufficient protection. Affected clients will be informed individually. |
| 21/10/2026 | 11:38 | e-net. lab - Publication of an explanatory article. The lab explains the PHP vulnerabilities and their potential consequences for businesses: interrupted sales enquiries, data exposure, business disruption and loss of trust. It also examines the potential role of AI in accelerating cyberthreats and the importance of a coordinated response. Read the article |
| 21/10/2026 | 09:34 | Patchstack - Reports of active exploitation. The cybersecurity company says it has received reports from several hosting partners of active exploitation linked to the PHP vulnerabilities. This information reinforces the urgency of checks and preparing patches. It does not mean that websites managed by e-net. have been compromised. |
| 21/10/2026 | 07:06 | e-net. - Activation of a coordination and security response team. A dedicated team is coordinating technical checks, discussions with our hosting and cybersecurity partners, and the preparation of protective measures and client communications. |
| 21/10/2026 | Not specified | CERT-EU - Protection recommendations. CERT-EU publishes its recommendations: identify applications using PHP, prepare to apply patches immediately and consider isolating exposed applications when an immediate fix is not possible. |
| 21/10/2026 | Not specified | Prostack - Initial preventive measures announced. The hosting provider says it has disabled a file upload tracking feature based on as yet unconfirmed information about its involvement in the vulnerabilities. It presents this as a precaution and maintains that patches must still be applied. This announcement concerns its own infrastructure and does not confirm protection for e-net. websites. |
| 21/10/2026 | Not specified | W3Techs - A technology present on nearly 7 out of 10 websites. PHP is used by 69.3% of websites whose server-side programming language is identified. This widespread use gives the alert potentially major global significance. This figure does not represent the proportion of websites that are actually vulnerable, which depends on versions, configurations and the protection deployed. |
| 20/10/2026 | 23:42 | e-net. - Preparing protection scenarios. Working with our partners, our teams are examining options for fixes, temporary protection and, if necessary, targeted preventive suspension. The aim is to limit risk exposure while preserving website continuity as far as possible. |
| 20/10/2026 | 22:08 | e-net. - Checking technical environments. Our teams are identifying the PHP versions used by the websites we manage in order to prioritise checks and identify environments requiring particular attention. |
| 20/10/2026 | 21:42 | e-net. - Initial analysis of the PHP alert. Our teams are examining the available information to assess potential consequences for the websites we manage and identify the checks to carry out with our technical partners. |
| 20/10/2026 | 21:35 | watchTowr - Publication of a tracking advisory. The cybersecurity company publishes an advisory covering CVE-2026-109618 and CVE-2026-109619. It describes the reported risk of remote code execution and stresses that the range of affected versions still requires official confirmation. The advisory was subsequently updated on 21 October. |
| 20/10/2026 | 21:33 | PHP - Official announcement of two critical vulnerabilities. The security team confirms two vulnerabilities, each rated 9.2/10, and schedules a corrective release for 21 October at 16:00 Belgian time. It asks users to prepare updates and states that technical details and affected versions will accompany the patches. An earlier release remains possible in the event of technical disclosure or evidence of active exploitation. |
If your website requires a specific intervention or temporary suspension, you will also receive a personalised communication.
What we know about this alert
The official PHP team has announced two critical vulnerabilities, each rated 9.2 out of 10. The patches were announced for release on 21 October at 16:00 Belgian time, together with details of affected versions and exploitation conditions.
CERT-EU lists these vulnerabilities under the identifiers CVE-2026-109618 and CVE-2026-109619. The available information indicates a risk of remote code execution: under certain conditions, an attacker could cause code to run on a vulnerable server.
This alert concerns a technology used worldwide. It does not mean that all websites using PHP have been compromised. Exposure must be assessed according to the version actually in use, the server configuration and the protection available.
What the e-net. teams are doing
Our teams have been working with our hosting and cybersecurity partners since yesterday evening.
Our work focuses on identifying potentially affected configurations, analysing technical information and preparing solutions applicable to the websites we manage.
We are also preparing the checks needed after an intervention, particularly for forms, administration access and, where applicable, ordering functions.
Our priority is to make decisions suited to the identified risk and clearly inform you of their consequences for your business.
Could your website be temporarily suspended?
A preventive suspension could be necessary if reliable technical information confirms a significant risk and no adequate fix or protection can be validated immediately.
This decision would be taken in consultation with our technical partners for the websites concerned. CERT-EU also recommends considering the isolation of exposed applications when an immediate fix is not possible.
Any suspension would aim to limit exposure to risk. It would not, on its own, constitute proof of an intrusion.
If your website were to be suspended, you would receive specific information about the decision and next steps.
All PHP versions require checking
The distinction between a version that is still maintained and an older version matters for the availability of patches.
However, using PHP 8.2 to 8.5 is not enough to establish that a website is unaffected by these vulnerabilities. The configurations concerned must be checked against official technical information and guidance from our partners.
For versions earlier than PHP 8.2, official support from the PHP project has ended. We therefore need to check any solutions offered by suppliers. Depending on the situation, securing the website could require migration to a newer version and adjustments to the website.
How would a website be brought back online?
When a suspension is necessary, bringing the website back online depends on implementing a validated security solution and carrying out functional checks.
This solution may take different forms: applying a patch, updating the PHP environment or migrating with accompanying technical adjustments.
A restoration timeframe can only be confirmed once the solution applicable to the website has been identified. We will share the available information with affected clients as it is validated.
What are the arrangements for covering the work?
For applying the patch, our arrangements are based on the date of your contract :
- Contract less than three years old: the patch is applied free of charge by e-net.
- Contract three years old or more: a paid intervention, with terms communicated before any commitment.
If migration or additional adjustments are necessary, their scope and cost coverage will be clarified individually. Any additional paid service will be subject to a proposal in advance.
A question about your website?
Your usual contact at e-net. remains your point of contact. To help us handle your enquiry, please include your website address and the question or difficulty you are experiencing.
Our teams continue working with our partners to secure affected websites and limit the consequences for your business.
Official sources: