News · security
Why Daylit and Daylit's customers stay online during PHP2Shell
On 21 October 2026 PHP announced two critical flaws, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Whoever exploits them can run code remotely on a server that runs PHP. Because the fix only arrives at 16:00 Dutch time, Security.NL, RTL and the Dutch House of Representatives, among others, took their sites offline as a precaution.
Daylit stays online, and so do our customers' sites. Below we explain why that is responsible, and what we have already done.
Who went offline, and who did not
According to NOS and NU.nl, this afternoon these were among those unreachable:
- Government: DigiD, MijnOverheid, the Dutch House of Representatives, the ACM and the Dutch Water Authorities association.
- Media and telecom: RTL.nl and the RTL app, and the sites of Simpel, Ben and Youfone.
- Healthcare: among others Maastricht UMC+, Jeroen Bosch Ziekenhuis, Bravis, Albert Schweitzer Ziekenhuis, Haaglanden MC, St. Antonius and Elisabeth-TweeSteden Ziekenhuis.
- Hosting: MijnDomein took every site it hosts offline as a precaution, reportedly hundreds of thousands.
- Also: the Dutch football association KNVB and several clubs, and the flight data in the Schiphol app.
The Dutch NCSC had seen no exploitation yet, but assumes every internet-facing system with PHP is vulnerable until it is updated. Going offline is the safe choice for anyone who does not know exactly which PHP versions run, or cannot roll out the update quickly.
Those that stayed online either do not use PHP for the site itself, or know exactly what runs and can update at once. The latter is what Daylit is built for.
Why we stay online
Every site runs a PHP version that gets the fix. All our sites use PHP 8.2, 8.3 or 8.4, versions PHP still maintains. Anyone still on 8.1 or older gets no fix and has a real problem.
The known attack path is already closed. At 14:03 we changed two PHP settings on every site that, according to the researchers, make the attack harder (session.upload_progress off, sessions through cookies only). No restart was needed: not a single site was away.
The fix goes on automatically. Every half hour Daylit checks for new PHP packages. As soon as they are there, they are installed and PHP restarts, one site at a time per server, without your site going offline.
We are watching. If PHP starts a program that does not belong there, such as a shell or a download tool, we get an alert at once. That is the sign of a break-in through flaws like these.
A break-in stays inside one site. At Daylit every site has its own server, which cannot reach other sites or our internal network. Every night we compare the code of WordPress sites with the official version, and there are daily backups.
What do you need to do?
Nothing. Your site stays reachable and Daylit installs the fix as soon as it is out. You may update PHP yourself, but you do not have to.
Going offline is not free: a webshop loses orders and customers cannot find you. We choose measures that protect your site while it keeps running. If we see signs of a real attack, we step in and tell you right away.
We will update this post once every site has the fix.