Party
The Dutch government and NCSC-NL
took its own site offline
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| All PHP versions from 5 onwards are affected by at least one of the flaws The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1. | NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1) | disputed | 3/4 | NCSC-NL Wiz on X CERT-FR oss-security |
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | NCSC-NL |
| The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those services Primary statement. | the Dutch government | confirmed | 1/2 (1 blocked) | Rijksoverheid / NCSC-NL Dutch IT Leaders |
Its sources in the vault
- NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl Rijksoverheid (Dutch government) / NCSC-NL
- NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities NCSC-NL (Netherlands National Cyber Security Centre)