# The Dutch government and NCSC-NL: what they say

The Dutch government and NCSC-NL: took its own site offline; the claims this site attributes to them and their sources.

Party

# The Dutch government and NCSC-NL

took its own site offline

## Claims this site attributes to this party

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| All PHP versions from 5 onwards are affected by at least one of the flawsThe CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1. | NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1) | disputed | 3/4 | [NCSC-NL](../../sources/ncsc-nl-advisories/index.html) [Wiz on X](../../sources/x-wiz-io-php2shell/index.html) [CERT-FR](../../sources/certfr-2026-ale-014/index.html) [oss-security](../../sources/openwall-oss-security-109619-thread/index.html) |
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerableCounted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | [NCSC-NL](../../sources/ncsc-nl-php2shell-software-list/index.html) |
| The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and Overheid.nl, with no signs of active exploitation of those servicesPrimary statement. | the Dutch government | confirmed | 1/2 (1 blocked) | [Rijksoverheid / NCSC-NL](../../sources/rijksoverheid-ncsc-php-news/index.html) [Dutch IT Leaders](../../sources/dutchitleaders-websites-offline/index.html) |

## Its sources in the vault
- [NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl](../../sources/rijksoverheid-ncsc-php-news/index.html) Rijksoverheid (Dutch government) / NCSC-NL
- [NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities](../../sources/ncsc-nl-php2shell/index.html) NCSC-NL (Netherlands National Cyber Security Centre)

[Every party →](../index.html)


---
site v0.2.8 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/actors/rijksoverheid/index.html