On Wednesday 21 October 2026, organisations around the world took their websites offline because of two critical security flaws in PHP, the programming language that WordPress, among others, runs on. In the Netherlands, DigiD, MijnOverheid, the House of Representatives, the Data Protection Authority, RTL Nieuws and Tweakers were temporarily unreachable. The websites we host and maintain stayed online all day. That is no coincidence: it is exactly what we built Verploy, our own maintenance platform, for.

What happened

On 20 October, the PHP security team announced a critical security release. It concerned two flaws (CVE-2026-109618 and CVE-2026-109619) with a severity score of 9.2 out of 10. An attacker could exploit them with a simple request to the server to execute code remotely, and sample code was already circulating. The Dutch National Cyber Security Centre (NCSC) issued a warning and advised updating immediately or temporarily shielding systems. Many organisations chose to go offline as a precaution until the fixed PHP versions (8.2.35, 8.3.36, 8.4.27 and 8.5.12) became available on 21 October.

What Verploy and we did

Verploy monitors every website we host, day and night: which versions are running, whether every site is reachable and whether anything deviates. On 21 October the platform did what it does every day, only this time it really counted.

  • Monitored from the first warning. We followed PHP’s announcement and the NCSC’s reporting. Meanwhile, Verploy kept a continuous eye on all client sites: availability, security and unusual behaviour.
  • Patched on 21 October, without downtime. As soon as the fixed PHP versions were available, our servers in the EU were updated the same day. Verploy then checked per website whether everything still worked, so we did not have to guess.
  • Checked for exploitation. Using the data from Verploy and our server logs, we checked every client site: no break-in, no attack and no exploitation of the flaw was found.
  • Everything stayed online. Not a single website we host went offline, not even during patching. For our clients and their visitors, nothing was wrong.

Why this made the difference

Many organisations had to choose between two evils: leaving a vulnerable site online, or taking the site offline until the update was in place. If you have no visibility of what is running on the server and whether an update went through properly, you have no choice but to pull the plug. Verploy removes exactly that blind spot: we saw what was running, we saw the update succeed and we saw every site keep working. That is why on the 21st we could do what others could not: update without going offline.

What this means for you

If your website is hosted and maintained by us, you do not need to do anything. Your site runs on an updated server, is monitored by Verploy and gets an encrypted backup every night. The next critical update will go the same way: a controlled update, without your site going down.

Was your site offline yesterday? Or are you not sure?

Then this is the moment to arrange things differently. We take over WordPress websites that were built or hosted elsewhere: we move your site to our servers in the EU, get it technically in order and put it under Verploy’s monitoring. Hosting from € 7.50 and maintenance from € 19 per month (excl. VAT), without a long contract.

This is how we do it:

  1. Free website check. Leave your site’s address below. You will get a short, personal report by e-mail: is your site running on a safe PHP version, how are speed and findability, and what are the three improvements with the biggest impact.
  2. Free consultation. 30 minutes, in person or via video, in which we discuss what switching means for you.
  3. Switching without hassle. We move your site, test everything and switch on monitoring. You will not notice a thing, except that afterwards it is taken care of.

Book a free consultation   

Prefer to call? +31 (0)166 700204, Mon–Fri 9:00–17:30 CET.

Sources: Tweakers – PHP closes two critical flaws after websites were taken offline worldwide · Dutch central government (Rijksoverheid)