#CyberWeekly

Non-IT WordPress, WooCommerce, Drupal, Joomla, Magento and PrestaShop all run on PHP. Send your hoster or web agency one question today: which PHP version runs our website, and is it 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer. No clear answer by Friday: ask them to take the site offline until it is. An unpatched site lets a stranger take over the server it runs on, and whatever data the site holds.

IT Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, "php2shell") let a stranger run commands on the web server without logging in. Fixed on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official fix: distribution backport, or offline. Every host, not only the ones with a public website on them.

Is this your problem? Yes, if you have a website. Most run on PHP: WordPress, Drupal, Joomla, Magento webshops, Nextcloud, Roundcube webmail, phpMyAdmin, intranets built on Laravel. The researchers ran the attack successfully against all of these, including WordPress 7.1.2, the version we asked you to install in week 39. Your hoster may have fixed it already. Many had not by Wednesday evening, and they will not all tell you.

What happened On Tuesday 20 October the PHP team announced a critical fix for Wednesday at 16:00 Belgian time. It said what for: two flaws in the engine under most of the web, there since 2012. By early Wednesday afternoon the CCB (Centre for Cybersecurity Belgium, the federal cyber agency) was warning Belgian organisations. At 14:50 the Flemish government ordered every one of its PHP websites offline until the fix was in.

• Who went dark: Smartschool, VRT, Knack and the other DPG Media sites, the city of Ghent, the city of Brussels, UZA, Infrabel and the Port of Antwerp-Bruges. Also VDAB, VDK Bank, the finance ministry's sites (MyMinfin stayed up), Rock Werchter, the federal police, and the CCB's own site. Pharmacists could not fetch electronic prescriptions for part of the afternoon. In the Netherlands, DigiD and MijnOverheid went offline too (VRT liveblog).
• How bad: 9.2 out of 10. No password needed, standard settings vulnerable, and the attacker ends up running commands on your server. Amazon's decoy servers logged a first attempt on 17 October, four days before the fix existed (Help Net Security).
• Was anyone hit: by 18:35 the CCB's Miguel De Bruycker had no reports of hacked systems. Smartschool was back at 18:16, the DPG sites at 19:17, the Port at 21:36. Sites on an older PHP, which gets no official fix, may stay down longer.

Why the plug came out. Nobody could tell in time which of their hundreds of sites ran a vulnerable PHP, so they switched off the lot and checked with the lights off. The CCB was careful: install the update as soon as possible; going offline "is a decision for each company or organisation itself". CISA was blunter: if you cannot update now, or you run 8.1 or older, take it offline until you can.

Week 39 asked you to update WordPress to 7.1.2. That still stands, and it does not help here. The hole sits one floor down, in the engine WordPress runs on, and only whoever hosts your site can fix that floor. The week-39 steps stay valid for the floor above.

The one thing: find out today which PHP runs under every website and web tool you own, and switch off what cannot be fixed.

Three things to do this week:

1. Non-IT Ask the hoster or agency today, in one line: "Which PHP version runs our website, and is it 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer? If not, when?" Keep the answer; it is your first piece of evidence that you acted.
2. Non-IT List everything else that runs on PHP: the webshop, the intranet, the booking tool, webmail, Nextcloud, phpMyAdmin, the old site nobody took down. Same question for each, to whoever hosts it. No answer means vulnerable.
3. Non-IT Decide who may pull the plug. Flanders had one person who could say "all of it, off, now" at 14:50. Write a name and a deputy next to "website offline", and agree they do not need a meeting first.

IT CISA's list: inventory every PHP install, including the ones embedded in appliances and internal tools; internet-facing first; a web application firewall buys time, not a fix; watch for PHP worker processes starting a shell. The "assess before you patch" step is in our guide on why updating matters even when nothing looks broken.

Closed for repairs: the sign on half of Belgium's websites on Wednesday was not a failure. It was the plan working.

Non-IT Two lines this week. Register at Safeonweb@work, the CCB's free self-check, and sign up for its warnings about threats seen on your network. Then make sure a named person may disconnect a system at the first odd sign, before anyone agrees what happened.

IT Nothing to update. The CCB's list of causes is your work list for client reviews: a second login step on admin and remote access first, fewer systems reachable from the internet, exploited flaws before anything else, backups a hacker cannot reach.

What happened On 15 October the CCB published its count for the year so far. 588 incident reports from Belgian organisations between 1 January and 28 September, already more than the 556 for all of 2025 and the 372 of 2024. Account takeovers: 156 in nine months, against 144 last year and 72 the year before. Systems taken over: 97, nearly double the 50 of 2025. Eighty ransomware attacks recorded so far this year (ITdaily, Brussels Times).

What the CCB reads in it. Attackers use AI to find a flaw and use it faster. Wednesday's PHP afternoon was the live version: decoy servers saw the first attempt four days before the fix existed.

Its advice, in the CCB's order:

• A named owner for each key measure, so nobody assumes someone else is on it.
• A second login step, admins and remote access first.
• Fewer systems reachable from the internet.
• Actively exploited flaws fixed before anything else.
• Disconnect fast at the first suspicious sign.
• Staff who check payment requests before paying.
• Backups a hacker cannot reach.

The fifth line, disconnect fast, is the decision Flanders took at 14:50, and the one week 42's incident page asked you to write down. If that page exists, add the name of who may pull the plug; if not, our incident response guide starts it. The second login step is in our 2FA basics.

588 signs in nine months. Better to hang yours at ten to three than to find one a hacker hung overnight.

Non-IT Forward this section to your IT partner and ask for a yes on each of the three rows.

IT Per product: the flaw, the fix, the deadline and who checks.

• PHP
  Flaw: CVE-2026-109618 and CVE-2026-109619, unauthenticated remote code execution, exploited
  Fix: 8.5.12, 8.4.27, 8.3.36, 8.2.35; 8.1 and older: distribution backport or offline
  Do by: now
  Who checks: IT on every host, or the hoster for shared hosting
• BeyondTrust Remote Support
  Flaw: CVE-2026-102764, authentication bypass by spoofing, exploited since 29 August
  Fix: BT26-05-RS patch for 24.3.1 to 26.2.3; older versions upgrade first; the cloud version was fixed on 9 October
  Do by: now (CISA's deadline was 19 October)
  Who checks: IT or whoever runs the remote-support server
• Fortinet
  Flaw: CVE-2025-61624, path traversal in the command line, needs an admin login, on CISA's exploited list since 16 October
  Fix: FortiOS 7.6.5 or 7.4.10; FortiProxy 7.6.5 or 7.4.12; FortiSwitchManager 7.2.8 or 7.0.7; FortiOS 7.2, 7.0 and 6.4 migrate to a fixed release
  Do by: this week
  Who checks: IT

In plain words:

• PHP. Who should care: anyone with a website or a web tool, see the lead. Ask: "Which PHP version runs our site, and is it one of the four fixed ones?" Technician: the php.ini workarounds going round are partial, not a fix. For 7.4, 8.0 and 8.1, watch your distribution's security feed for a rebuilt package and keep the host off the internet until one lands. Then check the logs since 17 October for PHP workers that started a shell.
• BeyondTrust Remote Support (formerly Bomgar). Who should care: anyone whose IT partner takes over staff screens with it. Ask: "Do you reach our PCs with BeyondTrust Remote Support, and is the BT26-05 patch on it?" Unpatched, a stranger on the internet gets in as if they had a login. Technician: self-hosted 26.2.3 and earlier; a suspected state-backed group has used it since 29 August; CISA's deadline was 19 October. Versions in the Canadian Cyber Centre's alert.
• Fortinet, again. Who should care: anyone with a FortiGate firewall. Ask: "Is our FortiGate on 7.6.5 or 7.4.10?" Technician: a medium-rated flaw from April, because it needs an admin login; on CISA's exploited list since 16 October. Our reading: week 41's stolen stash is exactly that admin login, which is why a medium flaw gets a deadline this week.

Delhaize, one week on. On 19 October Ahold Delhaize filed a report with the Dutch police, said it had notified the Dutch NCSC within 24 hours, and still had no evidence that customer data was taken. E-commerce in Belgium is fully operational; Albert Heijn home deliveries were expected back from 23 October (company update). The one-page incident plan from week 42 stands.

Closed for repairs until all three rows say yes. Then the shutter goes up again.

New here? Easy Cyber Protection (ECP) is the platform IT partners use to get small and mid-sized firms ready for a CyFun audit under NIS2. Most firms use it through their IT partner.

This week ECP got a new order. Your dashboard now shows the whole road in one box, Road to audit-ready, with a done-out-of-total count per phase. Risks now come before documents.

• 0. Level. Pick the CyFun level you aim for: Basic, Important or Essential. The higher the level, the more you have to prove.
• 1. Environment. Connect your tools and list your devices, accounts and people.
• 2. Assess risks. Sort what you own into security groups, such as servers, workstations or the directors' phones, because each can carry different risks. Then assess each group, log the findings, and turn them into a register and a roadmap.
• 3. Documents. Fill in, review and approve your policies, and have staff read them.
• 4. Do and keep records. Training, backup tests, exercises, changes, management review and policy reviews: the proof that you do what your policies say.
• 5. Audit-ready. Check that your proof is complete, export your file, and invite the inspection body.

IT Clients mid-way keep every step and its data. Only the order and the phase each step sits in changed. Documents, the records page and Audit carry a phase chip; tap it for the next step.

Non-IT Open your dashboard and do the first open step in your current phase. Everything else that shipped is in the changelog.