An official website stops responding just when someone needs to complete a procedure. That happened on October 21 on public portals in several European countries, removed for a few hours due to a security alert. Behind the closure there was two serious bugs in PHPa technology that most users never see.
The notice gave rise to a question that political scientist Jorge Galindo posed in X when he saw that the matter was barely explained outside of technical circles: “But are we aware of what just happened?” The answer begins by distinguishing pages disconnected from the internet As a whole: governments kept the network running while protecting specific services.
PHP is a language that works on the server, the computer where the request arrives when a page is opened. It can query a database, prepare the requested content, and send the result to the browser. If that part fails, the gateway to the server It can be exposed even if the screen the visitor sees appears normal.
The problem was behind the screen
The vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619 affect internal memory and error management tasks. According to the PHP Foundation and CERT-EU, under certain conditions an attacker could execute instructions on a server without having logged in. That would open the possibility of manipulating the system or accessing information it houses, depending on how each service is configured.
For this reason, some institutions decided to temporarily withdraw their portals. In the Netherlands, official services were affected, including identification tools and procedures. There were also Belgian portals offline as a precaution. In both cases, suspension reduced exposure while technical teams tested their systems and applied fixes.
A visible crash also does not allow us to know if someone has exploited the bug. Cybersecurity authorities recommend that each organization review its records and assess possible signs of intrusion. The fact that a website has been inaccessible describes a protective measure, it does not alone confirm an attack or data breach.
Fixes are now available
The team responsible for PHP published versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, which correct the two bugs. CERT-EU asks to update the exposed systems as soon as possible. If an entity cannot do so immediately, advise isolate the application from the internet until installing and checking the fix.
The task corresponds to those who manage the website or provide the accommodation, not to those who enter from their mobile phone. A visitor may find a portal closed and have to wait to complete a procedure; you don’t need to install PHP nor change your browser settings because of this alert. If you received a notice from the entity about your data, it is advisable to follow the official instructions of that service.
Older unsupported versions require a special patch. CERT-EU warns that some receive fixes from external vendors, while others must be migrated to a maintained branch. For those responsible for public pages, check the installed version and verifying that the update works will be the necessary step before returning normal access to citizens.