See more of Dutch Brief in your Google search results
Many Dutch websites, including important government services like DigiD and MijnOverheid, were taken offline on Wednesday 21st October, because of two newly found critical flaws in widely used web software. This outage is a precaution, not the result of a hack.
What’s causing the outage
The issue is with PHP, a common programming language used to build websites for government, news platforms, schools, and many businesses. Authorities say two serious vulnerabilities in PHP could let attackers run their own code on affected servers remotely, possibly taking full control of the system.
Since there isn’t a fix available yet, many organisations are taking vulnerable sites offline until a patch is ready. The PHP security team plans to release an emergency update on Wednesday afternoon, around 4pm Dutch time. The National Cyber Security Centre (NCSC) warned, “As long as that does not happen, any system that contains PHP and is reachable from the public internet is probably vulnerable,” and added that organisations using PHP face “a very high risk of complete takeover of the system by external attackers.”
SPONSORED
You’re overpaying your accountant. And they still don’t call you back.
Neno gives you a dedicated bookkeeper, automated admin, real-time financial insights and a free business bank account. Everything your business needs, in one place.
No chasing. No surprises. No unnecessary costs.
Which sites are affected
The list of affected sites grew throughout the day. Sites taken offline as a precaution included the government login system DigiD, the citizens’ portal MijnOverheid (both run by Logius), the House of Representatives (Tweede Kamer) website, the Dutch Data Protection Authority (AP), and even the NCSC’s own website.
The outage spread beyond central government. RTL’s news website and app went offline, along with the tech site Tweakers and several media sites from publisher DPG. Multiple provinces had issues because NotuBiz, which provides digital services to local authorities, was switched off, disrupting council live streams and document systems. The football association KNVB and clubs like FC Twente, Fortuna Sittard, and Willem II also took their sites down, as did the Union of Water Authorities. Parts of the higher education computer network were also partially disabled.
Is your data at risk?
The main thing to know is that taking a site offline as a precaution does not mean it was hacked or that personal data was stolen. The NCSC said that, as of now, there are no confirmed cases of active abuse of the flaws. However, security researchers have seen attackers starting to look for ways to exploit them, which is why organisations are acting fast.
Importantly, Ahold Delhaize, the parent company of Albert Heijn, said there is no link between this PHP flaw and the separate cyberattack that affected the supermarket chain a week and a half ago.
What this means for you
For most people, the main effect is that some websites and online services are temporarily unavailable. This includes DigiD, which is important for logging in to many government and healthcare services. The advice is simple: if a site is down, wait and try again later instead of looking for workarounds. Be extra careful with emails or messages offering an “alternative” login during the outage, since scammers often take advantage of situations like this. Services should start coming back once the PHP fix is installed this afternoon.