PHP vulnerabilities of October 21 had no impact on the NMD website

On October 21, 2026, many websites in the Netherlands and abroad went offline temporarily due to two serious security vulnerabilities in the PHP programming language. Now that things have settled down, we look at what this meant for milieudatabase.nl. The Stichting NMD website does not run on PHP, was not affected by the vulnerabilities and remained available throughout.

What happened?

The vulnerabilities, together known as PHP2Shell, made it possible to take control of a web server running PHP without logging in. Most websites use PHP.

Details of the vulnerabilities leaked before a security update was available. That explains why so many sites went offline as a precaution. When the update was released later that day, the Dutch National Cyber Security Centre (NCSC) advised installing it as soon as possible.

Why was the NMD website not affected?

The vulnerabilities were in PHP itself and only affected systems that run on it. After the news broke, we had our website checked for any use of PHP. It does not use PHP, so no emergency measures were needed. Our other online services, such as the data entry platform and the NMD Viewer, were not affected either.