Niet php.net · Niet NVD · Niet CISA

PHP-kwetsbaarhedentracker

Onofficiële briefing over beveiligingslekken in PHP

English简体中文日本語DeutschFrançaisNederlandsEspañol

Beveiligingswaarschuwing

PHP2Shell: werk PHP bij. Dat is de enige volledige oplossing.

CVE-2026-109618 en CVE-2026-109619 zijn kritieke kwetsbaarheden in PHP zelf die uitvoering van code op afstand zonder authenticatie mogelijk maken. Het PHP-project bracht op 21 oktober 2026 fixes uit voor de ondersteunde takken 8.2 tot en met 8.5. Herstart PHP na de update. Een firewall is geen vervanging.

Stappen om te patchen

Storingstracker

PHP2Shell-storingen: sites die offline gingen en wanneer ze terugkwamen

Overheidsportalen, universiteiten, platforms en bekende sites die op 21–22 oktober 2026 offline gingen, gemeld in verband met PHP2Shell. Vermelding betekent geen inbraak: de meeste gingen uit voorzorg of voor onderhoud offline.

Laatst bijgewerkt

55Gevolgde sites
8Nog offline
47Weer online
4h 59mMediane uitvaltijd

Per land

  • Nederland24
  • Wereldwijd11
  • Japan5
  • Frankrijk3
  • Finland3
  • Verenigd Koninkrijk3
  • Duitsland2
  • België2
  • Oostenrijk1
  • Kroatië1

Per type

  • Website24
  • Overheid17
  • Platform11
  • Universiteit3

🕒 Alle tijden in UTC (24 uur). De duur loopt van de eerste melding offline tot de eerste melding terug online.

Onze notitie
LIFULL HOME'SJapanPlatform——OfflineX-berichten Real-estate portal reported offline on X in connection with PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a CDN error, which may reflect regional blocking. [Bron]2026-10-22 08:35 · 403
SecureW2 MultiOS captive portal breakoutWereldwijdPlatform4h 47mOnlinePHPocalypse Tracker Network-access vendor took one component (the MultiOS advanced captive portal breakout) offline as a precaution while deploying PHP updates; its status page said its other services stayed up. Our check hit the vendor homepage, which blocks automated requests. [Bron]2026-10-22 09:55 · 403
at homeJapanPlatform——OfflineX-berichten Real-estate portal reported in maintenance/offline on X, with posts linking it to PHP2Shell; the operator has not stated a cause. Our check from outside Japan got a bot-check page, so it could not confirm the site's state. [Bron]2026-10-22 08:41 · 405
SUUMOJapanPlatform——OfflineX-berichten Real-estate portal reported offline on X in connection with PHP2Shell. The site shows its own system-maintenance page; the operator has not stated a cause. [Bron]2026-10-22 08:35 · 503
D66 (Dutch political party)NederlandWebsite2h 47mOnlinePHPocalypse Tracker Political party site showed a temporary unavailability page for under three hours. [Bron]2026-10-22 08:12 · 200
Nespresso Croatia online storeKroatiëWebsite15mOnlinePHPocalypse Tracker Online store offline briefly for stated security maintenance. [Bron]2026-10-22 08:12 · 200
Overheid.nl (Dutch government portal)NederlandOverheid12h 20mOnlinePHPocalypse Tracker Government portal offline for maintenance overnight; back the next morning (UTC). [Bron]2026-10-22 08:12 · 200
French prefecture websitesFrankrijkOverheid——OfflinePHPocalypse Tracker Several prefecture sites show a shared maintenance page; others not checked. [Bron]2026-10-22 08:12 · 200
Belgian Foreign AffairsBelgiëOverheid7h 06mOnlinePHPocalypse Tracker Ministry site returned HTTP 503 in four languages; back after midnight (UTC). [Bron]2026-10-22 08:12 · 302
City of Edinburgh CouncilVerenigd KoninkrijkOverheid5h 06mOnlinePHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about five hours. [Bron]2026-10-22 08:12 · 200
Oxford City CouncilVerenigd KoninkrijkOverheid4h 06mOnlinePHPocalypse Tracker Council site offline for maintenance (HTTP 503) for about four hours. [Bron]2026-10-22 08:12 · 200
Bristol City CouncilVerenigd KoninkrijkOverheid1h 21mOnlinePHPocalypse Tracker Council site showed an unavailability notice for under two hours. [Bron]2026-10-22 08:12 · 200
Port of RotterdamNederlandWebsite2h 36mOnlinePHPocalypse Tracker Port authority site temporarily unreachable for under three hours. [Bron]2026-10-22 08:12 · 301
KNVB (Dutch football association)NederlandWebsite1h 41mOnlinePHPocalypse Tracker Football association sites temporarily unreachable for under two hours. [Bron]2026-10-22 08:12 · 200
PVV (Dutch political party)NederlandWebsite8h 36mOnlinePHPocalypse Tracker Political party site offline as a stated precaution until the next morning (UTC). [Bron]2026-10-22 08:12 · 200
GroenLinks-PvdA (Dutch political party)NederlandWebsite1h 36mOnlinePHPocalypse Tracker Political party site offline for under two hours. [Bron]2026-10-22 08:12 · 403
Scaleway Dedibox Console and APIFrankrijkPlatform16h 45mOnlinePHPocalypse Tracker Hosting provider put its Dedibox management console and API into emergency maintenance as a precaution while it investigated and patched PHP2Shell. Scaleway said hosted servers and customer data were not affected; it reported the console back after the patches were applied. [Bron]2026-10-22 09:55 · 302
Acuity SchedulingWereldwijdPlatform3h 02mOnlinePHPocalypse Tracker Booking platform and login returned HTTP 503 for about three hours, then returned. [Bron]2026-10-22 08:12 · 200
DriveThruRPGWereldwijdWebsite7h 11mOnlinePHPocalypse Tracker Digital game store offline for maintenance for about seven hours. [Bron]2026-10-22 08:12 · 403
Sakura Internet (domains and SSL)JapanPlatform5h 46mOnlinePHPocalypse Tracker Domain and SSL control panel under emergency maintenance; notices do not name PHP; hosting and email unaffected. [Bron]2026-10-22 08:12 · 200
EFRAG (European Financial Reporting Advisory Group)BelgiëOverheid3h 08mOnlinePHPocalypse Tracker Site stopped connecting for about three hours, then returned. [Bron]2026-10-22 08:12 · 301
DeviantArtWereldwijdWebsite4h 32mOnlinePHPocalypse Tracker Art community suspended while applying a software update, then returned. [Bron]2026-10-22 08:12 · 200
DigiDNederlandOverheid5h 35mOnlinePHPocalypse Tracker Government login service offline for about six hours, then returned. [Bron]2026-10-22 08:12 · 200
MijnOverheidNederlandOverheid3h 35mOnlinePHPocalypse Tracker Government citizen portal offline for under four hours, then returned. [Bron]2026-10-22 08:12 · 200
RTL NieuwsNederlandWebsite3h 32mOnlinePHPocalypse Tracker News site offline for under four hours, then returned. [Bron]2026-10-22 08:12 · 302
Follow the MoneyNederlandWebsite2h 50mOnlinePHPocalypse Tracker Investigative news site offline for about three hours, then returned. [Bron]2026-10-22 08:12 · 200
Platform InvesticoNederlandWebsite1h 44mOnlinePHPocalypse Tracker Journalism platform offline for under two hours, then returned. [Bron]2026-10-22 08:12 · 200
Nederlandse Orde van Advocaten (Dutch bar association)NederlandOverheid1h 44mOnlinePHPocalypse Tracker Bar association site offline for under two hours, then returned. [Bron]2026-10-22 08:12 · 200
FC TwenteNederlandWebsite5h 50mOnlinePHPocalypse Tracker Football club site offline for about six hours, then returned. [Bron]2026-10-22 08:12 · 301
Fortuna SittardNederlandWebsite4h 05mOnlinePHPocalypse Tracker Football club site offline for about four hours, then returned. [Bron]2026-10-22 08:12 · 301
Politievakbond ACP (police union)NederlandWebsite16h 34mOnlinePHPocalypse Tracker Police union site offline until the next morning (UTC). [Bron]2026-10-22 08:12 · 301
KNMP (Dutch pharmacists' association)NederlandWebsite2h 20mOnlinePHPocalypse Tracker Pharmacists' association site offline for about two hours, then returned. [Bron]2026-10-22 08:12 · 200
Scouting NederlandNederlandWebsite1h 44mOnlinePHPocalypse Tracker Scouting association site offline for under two hours, then returned. [Bron]2026-10-22 08:12 · 200
Kustwacht (Netherlands Coastguard)NederlandOverheid4h 35mOnlinePHPocalypse Tracker Coastguard site showed an unavailability page with emergency numbers; back later that day. [Bron]2026-10-22 08:12 · 301
Security.NLNederlandWebsite6h 05mOnlinePHPocalypse Tracker Security news site switched to maintenance mode, citing PHP2Shell as the reason. [Bron]2026-10-22 08:12 · 200
easybillDuitslandPlatform2h 20mOnlinePHPocalypse Tracker Invoicing web app offline (HTTP 503) as a stated precaution; vendor said data was safe. [Bron]2026-10-22 08:12 · 302
Choice of GamesWereldwijdWebsite2h 20mOnlinePHPocalypse Tracker Game publisher site showed a temporary 503 page, then returned. [Bron]2026-10-22 08:12 · 200
CNIL (French data protection authority)FrankrijkOverheid——OfflinePHPocalypse Tracker Data protection authority site returns a maintenance page (HTTP 503) with no stated reason. [Bron]2026-10-22 08:12 · 503
Tweede Kamer (Dutch parliament)NederlandOverheid8h 02mOnlinePHPocalypse Tracker Parliament website showed a maintenance notice; back the same evening. [Bron]2026-10-22 08:12 · 200
NCSC (Dutch national cyber security centre)NederlandOverheid7h 02mOnlinePHPocalypse Tracker National cyber security centre site taken offline; back the same evening. [Bron]2026-10-22 08:12 · 200
Autoriteit Persoonsgegevens (Dutch data protection authority)NederlandOverheid——OfflinePHPocalypse Tracker Data protection authority site offline; no recovery recorded by the source. [Bron]2026-10-22 08:12 · timeout
Valtori (Finnish central government web services)FinlandOverheid18h 07mOnlinePHPocalypse Tracker Shared government web services offline; recovery recorded the next morning (UTC). [Bron]2026-10-22 08:12 · timeout
National Land Survey of FinlandFinlandOverheid——OfflinePHPocalypse Tracker Land survey agency site shown as down; no recovery recorded by the source. [Bron]2026-10-22 08:12 · 503
University of ViennaOostenrijkUniversiteit4h 17mOnlinePHPocalypse Tracker University website offline for a few hours, then returned. [Bron]2026-10-22 08:12 · 200
University of FreiburgDuitslandUniversiteit21h 01mOnlinePHPocalypse Tracker Home page carried a computing-centre notice about the PHP flaws; the tracker saw the regular home page again on 22 Oct at 08:10 UTC. [Bron]2026-10-22 08:24 · 301
Haaga-Helia University of Applied SciencesFinlandUniversiteit22h 46mOnlinePHPocalypse Tracker University took its website, Moodle and study guide offline for a day-long critical security update; the PHPocalypse Tracker recorded the study guide working again on 22 Oct at 09:55 UTC. [Bron]2026-10-22 10:07 · 301
TweakersNederlandWebsite4h 59mOnlinePHPocalypse Tracker Tech news site offline for about five hours, then returned. [Bron]2026-10-22 08:12 · 403
Fur AffinityWereldwijdWebsite11h 47mOnlinePHPocalypse Tracker Art community offline until late evening (UTC). [Bron]2026-10-22 08:12 · 403
PinboardWereldwijdWebsite12h 02mOnlinePHPocalypse Tracker Bookmarking service offline until late evening (UTC). [Bron]2026-10-22 08:12 · 200
Miraheze (all wikis)WereldwijdPlatform10h 02mOnlinePHPocalypse Tracker Wiki farm offline across all hosted wikis, then returned. [Bron]2026-10-22 08:12 · 301
4chanWereldwijdWebsite11h 47mOnlinePHPocalypse Tracker Imageboard offline until late evening (UTC). [Bron]2026-10-22 08:12 · 302
NotuBiz council portalsNederlandPlatform——OfflinePHPocalypse Tracker Council meeting portals run by NotuBiz went offline; reported in connection with PHP2Shell. [Bron]2026-10-22 08:12 · 301
explain xkcdWereldwijdWebsite9h 59mOnlinePHPocalypse Tracker Community wiki went offline for several hours, then returned. [Bron]2026-10-22 08:12 · 301
Star Citizen WikiWereldwijdWebsite4h 59mOnlinePHPocalypse Tracker Fan wiki taken offline for about five hours, then returned. [Bron]2026-10-22 08:12 · 200
CodmonJapanPlatform9h 41mOnlinePHPocalypse Tracker Childcare communication service stopped under emergency maintenance; restored by the evening (UTC). [Bron]2026-10-22 08:12 · 200

„Onze check” is één HTTP-statusverzoek per site op het getoonde tijdstip: geen scan en geen kwetsbaarheidstest. Een 403 of time-out kan betekenen dat de site automatische verzoeken blokkeert.

Een site melden die offline ging

Weet u van een site die in verband met PHP2Shell offline ging, of die weer online is? Laat het ons weten. Elke melding wordt handmatig gecontroleerd voordat die als ‘Gebruikersmelding (gecontroleerd)’ in de tabel verschijnt.

Vragen

Zijn deze sites gehackt via PHP2Shell?

Niet volgens de bronnen. De meeste toonden een onderhouds- of voorzorgsmelding terwijl PHP werd bijgewerkt.

Waar komen de gegevens vandaan?

Uit de PHPocalypse Tracker (publiek domein); elke rij linkt naar de oorspronkelijke bron.

Welke tijdzone?

UTC. 17:05 UTC is 19:05 in Amsterdam (CEST).

Hoe vaak wordt bijgewerkt?

Overdag ongeveer elke 10 minuten, na verificatie.