Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Party
The Dutch government and NCSC-NL
took its own site offline
Claims this site attributes to this party
| Claim | Who says it | Status | Fact-check | Primary | Sources |
|---|---|---|---|---|---|
| All PHP versions from 5 onwards are affected by at least one of the flaws The CVE records list only 8.2 to 8.5 with defaultStatus 'unaffected'. php.net published source backports for 7.4, 8.0 and 8.1, which implies they are affected. A scanner that trusts the CVE record will miss 7.4 to 8.1. fact timeline → | NCSC-NL; Wiz ('>= 5.4'); CERT-FR (5.x, 6.x, 7.x, 8.0, 8.1) | disputed | A3 Echoed●●●○○○ disputed | 3/4 | NCSC-NL Wiz on X CERT-FR oss-security |
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. fact timeline → | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | A1 Weak signal●○○○○○ contradicted status overstated | 1/1 | NCSC-NL |
| The Dutch government took NCSC.nl offline as a precaution, with no active misuse seen yet; Dutch press reported DigiD, MijnOverheid and Overheid.nl offline too The government's notice names only NCSC.nl; DigiD and MijnOverheid rest on the press (fact-check desk, run 1: holds in part, overstated). fact timeline → | the Dutch government | reported | A4 Corroborated●●●●○○ | 1/2 | Rijksoverheid / NCSC-NL TPO.nl |
Its sources in the vault
- NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl Rijksoverheid (Dutch government) / NCSC-NL
- NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilities NCSC-NL (Netherlands National Cyber Security Centre)