PHP vulnerability takes down thousands of websites — is your site also at risk?

On 21 October 2026, dozens of major Dutch websites went offline unexpectedly. Not because of a power outage or a hack, but because of two critical security flaws in PHP — the programming language that powers an estimated 70% of all websites worldwide. Among the affected organisations: RIVM (the Dutch public health institute), ANWB, the Dutch House of Representatives, DigiD, MijnOverheid and several hospitals.

What exactly happened?

Security researchers discovered two severe vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619), collectively dubbed "PHP2Shell". These flaws allow an attacker to remotely take full control of a web server — without a password or credentials. The vulnerabilities are so serious that the Dutch National Cyber Security Centre (NCSC) advised affected websites to go offline until patches were available and installed.

The result: dozens of government, healthcare and corporate websites were unreachable for hours. Millions of Dutch citizens were temporarily unable to access DigiD, MijnOverheid or the RIVM's public health portal.

Why does this affect so many websites?

PHP is the engine behind a huge portion of the internet. Some examples:

• ✓WordPress — the world's most popular website platform (over 43% of all websites) runs entirely on PHP.
• ✓Many Wix websites use PHP for server-side processing of forms, payments and integrations.
• ✓Joomla, Drupal, Magento and many other popular platforms are built in PHP.
• ✓Even many "custom-built" websites and webshops run on a PHP foundation.

Do you have a WordPress website? Then there is a good chance your site is or was vulnerable right now, unless your hosting provider has already applied the PHP update. And even then, the risk remains as long as WordPress plugins have not been updated — many plugins contain their own PHP code.

What does this mean for you as a host?

If you run a holiday home, B&B or rental business, your website is your digital front door. Guests book there, pay there, and trust that their data is safe. A vulnerability like this can mean:

• ✓Your website is offline for hours — resulting in missed bookings.
• ✓Personal data of guests (names, email addresses, payment details) is stolen.
• ✓An attacker takes over your website and uses it for spam or phishing.
• ✓As a host, you are liable under GDPR if you cannot demonstrate that you had adequate security measures in place.

How do you prevent this?

There are roughly two routes:

1. Stay with WordPress or another PHP platform, but make sure your hosting provider applies PHP updates immediately, keep all your plugins up to date, and regularly check for vulnerabilities. This requires technical knowledge or a maintenance contract — and even then you are always playing catch-up, because you depend on how quickly updates are released.

2. Choose a platform that does not use PHP. Modern web applications run on safer, newer technologies that are not affected by PHP vulnerabilities. This eliminates an entire category of security risks.

How does Mikaflow handle this?

The websites and booking modules we build run on a modern, secure platform that does not use PHP. Today's PHP2Shell vulnerability does not affect our systems. No emergency patches, no downtime, no risk for you or your guests.

In addition, we take care of all technical management and security. You do not need to update plugins, monitor PHP versions or run security scans. We handle that.

Have your website built including booking module

Want to be fully taken care of as a host? We also build your complete website — including booking module, online payments (iDEAL, Bancontact, credit card), automatic synchronisation with Booking.com and Airbnb, and a professional design. Everything runs on a secure, modern platform without PHP.

You do not have to worry about anything: no commission per booking, no technical hassle, and a website that simply stays online — even when the rest of the internet is in trouble.

Curious? Visit our website at mikaflow.com or request a free preview website. 14 days free, no payment card required.