The Netherlands shut down DigiD today. The national authentication system used by 17 million citizens for tax, benefits, and healthcare went dark. MijnOverheid, the Tweede Kamer, and the Dutch Data Protection Authority followed. Finland’s Valtori closed all incoming traffic to government web services.
Not because of an attack. Because a patch had not arrived.
Two critical remote code execution vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619, CVSS 9.2) leaked before the fix was ready. Proof-of-concept exploits are circulating on GitHub. The exploit fires during request parsing, before application code runs. Web application firewalls see nothing.
PHP powers 70.8% of all websites with a known server-side language. WordPress, which runs on PHP, powers 43%. Every WordPress site, every Drupal government portal, every WooCommerce store processing card payments was running a checkout on a stack with a known pre-authentication RCE and no patch. That is not a security incident. It is a PCI-DSS event.
The organisation maintaining PHP received $683,550 in funding last year. Ten developers. One volunteer RPM packager for Red Hat and Fedora, unavailable when the patch shipped. The Foundation’s entire annual budget is less than today’s shutdowns cost two EU governments in one afternoon.
No government funds the PHP Foundation. No government audits PHP core. No government had advance access to the patch. The only option for two member states with well-funded national cyber security centres was to turn everything off and wait for volunteers in another country.
Germany’s Sovereign Tech Fund has invested millions in open source but has not funded PHP. The OpenSSF Alpha-Omega programme funds security teams at the Python, Eclipse, and Rust foundations but not PHP. The EU Cyber Resilience Act makes end-of-life open source a legal liability from December 2027. The mechanisms exist. The will to apply them to PHP does not.
“Governments should not use PHP” misses the structural point. Every runtime has vulnerabilities. The issue is that sovereign states run critical citizen-facing systems on a stack they do not fund, govern, audit, or patch. Replacing PHP with another language changes the name on the dependency. It does not change the dependency.
Hostinger, GoDaddy, and SiteGround will force-patch their managed hosting customers within hours. That fixes the commercial web. It does not fix self-hosted government systems, enterprise deployments, or the 35% of WordPress sites still on PHP 7.4, unsupported since 2022, for which no patch exists. The news cycle will move on. The exposure will not.
#DigitalSovereignty #PHP2Shell #CyberSecurity #OpenSource #CyberResilienceAct