LinkedIn Carousel - #CyberWeekly Week 43

Belgium Switched Its Websites Off. Is Yours Exposed?

WordPress, Drupal, Magento: all PHP. Ask your hoster today.

CCB: 588 incidents

Three fixes for your IT partner

ECP: risks come first

Easy Cyber Protection

Your to-do list

This week's cyber to-do list

For you

Ask your hoster or web agency which PHP version runs your website, and whether it is 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. Today.
List everything else of yours that runs on PHP (webshop, intranet, booking tool, webmail, Nextcloud, phpMyAdmin) and ask the same question for each. This week.
No clear answer, or PHP 8.1 or older: have the site taken offline until it is fixed. Friday 23 October.
Write a name and a deputy next to "website offline", no meeting needed, and register at Safeonweb@work for the CCB's warnings. This week.

For your IT partner

Forward this list. Ask for Done, Not applicable or a date on each line.

PHP: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on every host, websites and internal tools alike (CVE-2026-109618, CVE-2026-109619, exploited). PHP 8.1 and older: distribution backport or offline. Now.
BeyondTrust Remote Support (self-hosted): BT26-05-RS patch on 24.3.1 to 26.2.3; older versions upgrade first (CVE-2026-102764, exploited since August). Now.
FortiOS 7.6.5 or 7.4.10, FortiProxy 7.6.5 or 7.4.12, FortiSwitchManager 7.2.8 or 7.0.7 (CVE-2025-61624, on CISA's exploited list since 16 October). This week.
On every web host, check the logs since 17 October for PHP worker processes that started a shell. This week.

1/5

Belgium pulled its websites. On purpose.

Week 39 asked you to update WordPress to 7.1.2.

Your website probably runs on PHP, the software under the site. WordPress, WooCommerce, Drupal, Joomla, Magento, PrestaShop: all PHP. Non-IT Ask your hoster today which version. IT 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on every host.
Two flaws hackers already use. IT BeyondTrust BT26-05 patch now; FortiOS 7.6.5 or 7.4.10 this week.
588 reports to the CCB in nine months. Non-IT Name who may pull the plug.

VRT NWS liveblog: Belgian sites offline ahead of the PHP fix, CCB and Flemish government statements (21 Oct 2026) → https://www.vrt.be/vrtnws/nl/liveblog/bezorgdheid-na-beveiligingsupdate-blijft-komende-uren-zullen-u~1792586431409

2/5

by Patch, our friendly house bot

— Patch, your friendly house bot

Patch, our house bot, writes: I spent Wednesday afternoon with a marker and a piece of cardboard. CLOSED FOR REPAIRS, taped to the front of the rack.

3/5

The CCB counted 588 incidents by September

Its advice, in the CCB's order:

A named owner for each key measure, so nobody assumes someone else is on it.
A second login step, admins and remote access first.
Fewer systems reachable from the internet.
Actively exploited flaws fixed before anything else.

ITdaily: CCB counts more cyber incidents in Belgium in nine months than in all of 2025 (16 Oct 2026) → https://itdaily.com/blogs/security/ccb-more-cyber-incidents-in-belgium/

4/5

Closed for repairs: three fixes for your IT partner

In plain words:

PHPFlaw: CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution, exploitedFix: 8.5.12, 8.4.27, 8.3.36, 8.2.35; 8.1 and older: distribution backport or offlineDo by: nowWho checks: IT on every host, or the hoster for shared hosting
BeyondTrust Remote SupportFlaw: CVE-2026-102764, authentication bypass by spoofing, exploited since 29 AugustFix: BT26-05-RS patch for 24.3.1 to 26.2.3; older versions upgrade first; the cloud version was fixed on 9 OctoberDo by: now (CISA's deadline was 19 October)Who checks: IT or whoever runs the remote-support server
FortinetFlaw: CVE-2025-61624, path traversal in the command line, needs an admin login, on CISA's exploited list since 16 OctoberFix: FortiOS 7.6.5 or 7.4.10; FortiProxy 7.6.5 or 7.4.12; FortiSwitchManager 7.2.8 or 7.0.7; FortiOS 7.2, 7.0 and 6.4 migrate to a fixed releaseDo by: this weekWho checks: IT
PHP. Who should care: anyone with a website or a web tool, see the lead. Ask: "Which PHP version runs our site, and is it one of the four fixed ones?" Technician: the php.ini workarounds going round are partial, not a fix. For 7.4, 8.0 and 8.1, watch your distribution's security feed for a rebuilt package and keep the host off the internet until one lands. Then check the logs since 17 October for PHP workers that started a shell.

PHP security advisory: CVE-2026-109618 and CVE-2026-109619 fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 Oct 2026) → https://www.php.net/archive/2026.php#2026-10-21-5

5/5

New in ECP: six phases from your level to audit-ready

New here?

0. Level. Pick the CyFun level you aim for: Basic, Important or Essential. The higher the level, the more you have to prove.
1. Environment. Connect your tools and list your devices, accounts and people.
2. Assess risks. Sort what you own into security groups, such as servers, workstations or the directors' phones, because each can carry different risks. Then assess each group, log the findings, and turn them into a register and a roadmap.

See everything that shipped → https://easycyberprotection.com/changelog/

Read the full issue

5 stories. Context that matters.
Belgian cybersecurity, weekly.

Scan to read online

https://easycyberprotection.com/cyberweekly/2026/week-43

Follow #CyberWeekly

easycyberprotection.com