On Tuesday 20 October 2026, the makers of PHP announced an update for two critical vulnerabilities. A day later, websites of governments, hospitals and media in several European countries went offline as a precaution. In this course, employees, IT administrators and board members look back on those days and learn what to do differently at the next critical vulnerability.
PHP is the software that runs an estimated seventy percent of all websites. Through the two vulnerabilities, a cybercriminal could take over a server without logging in. The announcement therefore worked as a starting shot: even before the update was available, cybercriminals were already scanning for vulnerable systems.
A vulnerability like this affects everyone in the organisation, but not everyone has the same task. The course therefore consists of a short introduction, three modules for three roles and one shared test. All modules take place in the same fictional organisation, so every participant sees how their role connects to the others.
- In the module for employees (10 minutes) the customer portal goes offline, and that evening Sara receives an email with a button to download the security update. The participant learns to recognise and report such a message, even after already clicking.
- In the module for IT administration and information security (12 minutes) David and Lena have one morning to decide which systems go offline. The participant learns to weigh the cost of a breach against the cost of downtime, to update safely and to look for traces of a break-in afterwards.
- In the module for the board (10 minutes) the board meets for three quarters of an hour while the customer portal stays online and vulnerable. The participant learns which decisions the board takes in advance about risk appetite, continuity, mandate and suppliers.
All participants finish with the same test. From a set of 25 questions each participant gets 10, and anyone who scores 35 out of 50 points passes. With the introduction, their own module and the test, a participant spends about twenty minutes.
The course is available in 27 languages. PHP is the example and the legislation in the course is European, so the content fits every European country.
What does the participant learn?
- Why one vulnerability in widely used software takes down so many services at once.
- How to recognise and report messages with which cybercriminals ride along on the news.
- How to establish quickly, during a critical vulnerability, where the software runs, who supplies the update and how much time you have.
- How to choose per system between going offline, a limited emergency mode, and staying online with a consciously accepted residual risk.
- Which decisions the board takes in advance, so that a decision on the day itself takes two minutes instead of three quarters of an hour.
- Who does what on a day like that, and when the reporting duties under the GDPR and the NIS2 directive apply.
Who is this course for?
The course is meant for the whole organisation. Every participant takes the introduction, the module for their own role and the test. Employees take the module on recognising and reporting. System administrators, application administrators and security officers take the module for IT administration and information security. Board members, directors and process owners take the module for the board.
Why this course matters now
The PHP vulnerability is not an exception. The time between the disclosure of a vulnerability and the first abuse keeps getting shorter, partly because cybercriminals use AI. Anyone who only starts weighing the options when the first scans arrive is too late.
On top of that, the NIS2 directive requires organisations to have risk analysis, business continuity and crisis management in order, with the board overseeing it. A significant incident needs a first report within 24 hours. The course uses an event everyone still remembers, and the lessons apply to every next critical vulnerability.