Sites go dark across Belgium

On Wednesday, 21 October, a wide range of websites in Belgium went offline as a precaution after PHP Group disclosed two vulnerabilities in the programming language on Tuesday, 20 October. The Flemish government shut down its official sites that run on PHP, and the Flemish Parliament portal was in the same position. Smartschool, the learning platform schools use for communication between teachers, parents and pupils, was unreachable. Several Antwerp hospital sites, including those of AZ Monica and the university hospital UZA, were also suspended. DPG Media, the parent company of 7sur7 and HLN, took several of its websites down, and the federal finance service (SPF Finances) suspended its informational sites.

Beyond Belgium, the websites of the University of Geneva and the University of Basel, the French data protection authority CNIL and several French Interior Ministry sites were down. Dutch public services were also inaccessible. The Belgian Centre for Cybersecurity (CCB) said its own website was offline as a consequence of the flaw.

The flaw and the patch

PHP Group, the organisation behind the technical architecture of the language, reported two vulnerabilities that are described as critical. The update fixing both was released shortly after 16:00 and applies to PHP versions from 8.2 onward. The company strongly urged site administrators to install it immediately. Sites running older versions receive no direct fix and must first move to a newer release. PHP underpins systems such as WordPress and Drupal, and 7sur7 reports that it is used by nearly 70% of websites.

Kenneth Dée, a technology expert speaking to 7sur7, put it simply:

“PHP is a programming language, like many others.”

He added that the risk comes from how much of the web depends on it. In theory, attackers who reached the server hosting a site could take control of it, disable it or add their own content.

Flemish minister-president Matthias Diependaele announced the shutdown of the regional sites in a message on X.

“Continuity and security of digital services for our citizens are our absolute priority.”

He said he had instructed the temporary, precautionary shutdown of all Flemish government websites running on PHP, with the full list of affected sites and services to follow as soon as possible.

Attacks so far and precautionary steps

Cloudflare, a US cybersecurity company, said it had seen attempts to exploit the vulnerability against companies, and European cybersecurity authorities had warned of such attacks on Wednesday morning. The CCB, however, said it had recorded no attacks on Belgian websites so far. Its spokesperson Katrien Eggers told Belga that organisations unable to install the fix immediately should take their sites offline as a precaution. The shutdowns, the CCB stressed, do not mean that any site had been hacked.

The foreign affairs service said its sites were offline because of the two critical flaws and referred to information about cyberattacks, although the CCB said it knew of none against Belgian sites. Some companies chose to suspend access without waiting to see whether an intrusion would occur. Reports on the day also said data had not been confirmed as stolen.

What comes next

Cybersecurity experts urged companies and internet users to stay alert in the coming days. The Flemish government has promised to publish the full list of affected sites and services as soon as possible, while the security update remains the step recommended to every affected organisation.