The Dutch National Cyber Security Centre (NCSC) has confirmed that active exploitation of a critical vulnerability in the PHP programming language is now underway. While the agency previously reported no evidence of compromise, recent intelligence indicates that threat actors are using the flaw to target systems across multiple sectors.
Strategic Implications for Digital Infrastructure
- Active Exploitation: After initial uncertainty, the NCSC has moved to confirm that unauthorized parties are successfully abusing the PHP vulnerability.
- Patch Deployment: Official patches were released on October 22, 2026, at approximately 16:00, necessitating immediate server-side updates to mitigate ongoing risks.
- Exposure Metrics: Approximately 145,000 Dutch websites remain in a high-risk category due to the use of legacy PHP versions that may lack adequate security patches.
The Shift in NCSC Threat Intelligence
The NCSC’s latest assessment marks a departure from the position held earlier in the day. On October 22, 2026, NCSC Director Matthijs van Amelsfort stated during a broadcast on Pauw & De Wit that there were no signs of “active abuse,” despite observing an uptick in suspicious online traffic. By late afternoon, the agency’s stance evolved. A spokesperson for the NCSC reported that the organization is now receiving signals from both domestic and international partners confirming that the vulnerability is being actively weaponized.
The agency has declined to provide granular detail regarding the nature of these attacks, citing an ongoing investigation that is expected to continue for several months. The technical gap centers on the PHP language itself, a foundational component for a significant portion of the global web. Because many organizations operate on legacy codebases, the transition to secure versions is not instantaneous.
Impact on Government and Corporate Continuity
The operational fallout from the vulnerability was immediate. On October 22, several critical entities moved to take their digital infrastructure offline as a precautionary measure to prevent data exfiltration or system compromise. Affected organizations included government portals, the news outlet RTL Nieuws, the meeting management system Notubiz, and the accounting software provider Exact.
| Status of PHP-Based Websites | Estimated Count |
|---|---|
| Updated (Protected) | 113,000 |
| Potentially Vulnerable | 145,000 |
NCSC Urges Rapid Deployment of PHP Security Patches
The NCSC’s primary directive remains the rapid deployment of the security patch made available shortly before 16:00. Data analyzed by NOS indicates that while 113,000 Dutch websites have already updated their PHP versions, the remaining 145,000 sites represent a significant, unaddressed attack surface. These sites are not necessarily confirmed as compromised, but they lack the latest security architecture required to deflect current exploitation attempts.
The urgency of these updates is compounded by the fact that the vulnerabilities within PHP are not necessarily new, but their exploitation has reached a state of critical mass.
As the NCSC spokesperson noted, the agency is actively monitoring the situation through a wide network of domestic and international organizations, ensuring that the response to the ongoing abuse remains coordinated as the investigation progresses.
