Critical PHP flaw takes Belgian websites offline: what businesses should check

On 21 October 2026, the PHP Foundation rushed out a fix for two critical flaws in PHP, the language that powers roughly 70% of the world's websites. As a precaution, DPG Media, Roularta, Smartschool and the federal police took several Belgian sites offline while the patch was applied, according to RTBF and La Dernière Heure. The Centre for Cybersecurity Belgium urged every business to install the update without delay. For an SME with a website, what matters is the PHP version on the hosting server, not WordPress itself.

1. A flaw in the PHP engine, not in WordPress

The two flaws patched on 21 October sit in PHP itself, the engine that runs the code behind most websites, not in a plugin or a theme. According to La Dernière Heure, they allow an attacker to take full remote control of a server without a password or a user account.

A perfectly updated WordPress or PrestaShop site can therefore still be exposed if the PHP version on the hosting hasn't received the patch. The safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later.

2. Major Belgian sites taken down as a precaution

On 21 October, DPG Media and the Roularta group (Le Vif, Trends-Tendances, Flair, Femmes d'Aujourd'hui) temporarily suspended several sites, as did the Smartschool education platform widely used in Flanders, RTBF reports. The federal police website and several federal portals also went offline, while the 101 emergency line kept working.

According to the Centre for Cybersecurity Belgium, no confirmed attack targeted a Belgian site at the time. The shutdown was a precaution, while the patch issued by the PHP Foundation was installed.

3. Why businesses now react faster than before

For Charles Cuvelliez, a cybersecurity expert at ULB quoted by La Libre, the novelty isn't the flaw itself. It's the chain reaction it triggers. Organisations now shut down systems as a precaution, rather than waiting for a confirmed attack.

He compares it to the 2014 Heartbleed flaw, which affected 80% of servers without causing a general shutdown. Today, the window between a flaw being disclosed and being exploited has shrunk sharply.

4. What it means for an SME with a website

Most small businesses don't have an in-house team tracking security flaws daily. If hosting is managed by a provider, the PHP update should happen automatically. On unmanaged hosting or a dedicated server, it's up to the business to check.

A site going down, even for a few hours, also interrupts contact forms, the landing pages of running ad campaigns and online booking. After an emergency patch, checking that these still work matters as much as the patch itself.

The AI lens, humans first

Once a flaw is published, artificial intelligence can scan a fleet of sites and spot exposed PHP versions within minutes, which feeds the concern raised by experts quoted by La Libre about how quickly exploits can now be built. But deciding to take a site offline mid-campaign, choosing a hosting provider that will patch in time, and checking that forms still work after the update remain human calls. AI executes. Expertise decides, and keeps watch.