Livelast change 5 min ago
Dutch sites offline over PHP flaw
Since 09:23 · The Hague
Now
- Issue
- PHP software vulnerability
- Affected entities
- Dutch municipal websites and services
- Action taken
- Precautionary system shutdowns
Germany's CERT-Bund calls the PHP flaws, dubbed PHP2Shell (CVE-2026-109618, CVE-2026-109619), an acute emergency, Berliner Zeitung reports.
Berliner Zeitung (opens in a new tab)telegraaf.nl (opens in a new tab)us.headtopics.com (opens in a new tab)
Brabant hospitals Jeroen Bosch, ETZ and Bravis have websites offline over the PHP flaw, AD reports.
AD.nl (opens in a new tab)leidschdagblad.nl (opens in a new tab)appleinsider.com (opens in a new tab)
Supermarket chain Hoogvliet has taken its website offline as a precaution over the PHP flaws, AD reports. Customers in the Groene Hart region cannot use the site for now.
AD.nl (opens in a new tab)nd.nl (opens in a new tab)vz.ru (opens in a new tab)
Radboud University says its website is offline as a precaution. In Rotterdam, Ikazia Hospital and the Port of Rotterdam are also down, AD reports.
AD.nl (opens in a new tab)nrc.nl (opens in a new tab)dagelijksestandaard.nl (opens in a new tab)
DPG Media, owner of De Morgen, has taken several of its websites offline as a precaution over the PHP flaws, its spokesperson Thijs van Soest says.
De Morgen (opens in a new tab)nltimes.nl (opens in a new tab)accountant.nl (opens in a new tab)
NOS reports that FC Twente, public transport operator EBS, the municipality of Zwolle and Notubiz are offline as a precaution over the PHP flaws.
NOS (opens in a new tab)news.nate.com (opens in a new tab)accountant.nl (opens in a new tab)
The municipality of Nieuwkoop has taken its website offline as a precaution over the PHP flaws, according to AD.
AD.nl (opens in a new tab)news.nate.com (opens in a new tab)independent.co.uk (opens in a new tab)
Cloudflare reports the first attacks exploiting the PHP flaws, De Morgen reports. The municipality of Vlissingen has taken its entire website offline as a precaution.
De Morgen (opens in a new tab)AD.nl (opens in a new tab)mybroadband.co.za (opens in a new tab)
AD reports that 11 municipal websites in the Utrecht region, including Zeist, IJsselstein and Houten, are offline as a precaution over the PHP flaw.
AD.nl (opens in a new tab)nieuws.nl (opens in a new tab)metronieuws.nl (opens in a new tab)
DigiD and MijnOverheid are offline as a precaution, NOS reports, along with RTL.nl and Tweakers. The National Cyber Security Centre's own website is also down.
NOS (opens in a new tab)nd.nl (opens in a new tab)metronieuws.nl (opens in a new tab)
The NCSC says it has seen no active exploitation of the PHP flaws yet. PHP publishes fixes at 16:00 Dutch time; the Tweede Kamer and KNMP sites are offline.
de Volkskrant (opens in a new tab)metronieuws.nl (opens in a new tab)nd.nl (opens in a new tab)
Dutch municipalities take IT systems offline following a cybersecurity alert over PHP vulnerabilities, AD and De Gelderlander report.