See more of Dutch Brief in your Google search results
After critical flaws were discovered this week in PHP, a widely used web software, many people in the Netherlands have raised questions about cyber-security. These flaws led to dozens of websites being taken offline as a precaution and could, in theory, allow attackers to take over a server. But could they also affect smart devices at home, like a camera doorbell, a connected washing machine, or a robot vacuum? According to experts, the risk for most people is low.
Where the risk is
The National Cyber Security Centre (NCSC) warns that PHP can sometimes be found in smart home devices, and about 30 percent of Dutch homes have at least one internet-connected appliance. So the concern is real. However, security experts point out that most of these devices are very difficult to attack directly.
This is because of how these devices connect. Most smart devices are not directly exposed to the internet; they are on your home wifi, behind a router. “You could say most smart devices have a phone to call out, but no number you can call them on, so the risk is low,” said Daan Keuper from the security firm Computest. To access the device, an attacker would usually need to be on the same wifi network. Breaking in through the router to reach something like a smart washing machine is unlikely, said Michel van Eeten from TU Delft, because “there is almost no PHP in routers.”
SPONSORED
You’re overpaying your accountant. And they still don’t call you back.
Neno gives you a dedicated bookkeeper, automated admin, real-time financial insights and a free business bank account. Everything your business needs, in one place.
No chasing. No surprises. No unnecessary costs.
The manufacturer’s responsibility, not yours
For devices like smart doorbells, experts say that a hack is much more likely to happen through the manufacturer’s servers than through your home network. This means the vulnerability, and the responsibility, belong to the company, not the user. “Suppliers have an obligation to keep their own systems secure,” said Juriaan Spierenburg from the NCSC, referring to the new Cyber Resilience Act. He expects most suppliers to follow the rules, but admits it is uncertain whether every manufacturer from every country will update quickly.
One weak point to watch out for is a Network Attached Storage device (NAS), which is a hard drive connected to your network that you can access from outside your home, for example to upload holiday photos. Since it can be reached from the internet, it carries more risk. Older devices are also a concern because they might use an outdated version of PHP that no longer gets updates.
What you can do
The good news, confirmed by the NCSC, is that the risk of the PHP flaw being widely abused is smaller than first feared, and it is hard to exploit. It is also nearly impossible for most people to know if their devices even use PHP; as one expert said, many companies do not know either.
If you want to be careful, the advice is straightforward: install all available updates for your devices, apps, and systems. Make sure your smart devices can only be reached through your home network, and consider using a firewall or VPN if needed. If a device is accessible from the internet and you are concerned, you can turn it off for a few days and wait to see what the manufacturer does. The main lesson is the same as always: keep your software up to date.