At 07:43 UTC on October 21, 2026, Cloudflare saw the first attacks. The fix would not exist for another six hours and seventeen minutes. By lunchtime in Europe, the Dutch national cybersecurity agency had taken its own website offline. DigiD, MijnOverheid and the Tweede Kamer were dark. Finland's state IT provider had pulled government network services, and France's Interior Ministry had switched off local administrative sites. The cause was a pair of PHP flaws, CVE-2026-109618 and CVE-2026-1...