Dutch sites offline over PHP flaw

Dutch municipalities take IT systems offline following a cybersecurity alert over PHP vulnerabilities, AD and De Gelderlander report.

news.mynavi.jp (opens in a new tab)

The NCSC says it has seen no active exploitation of the PHP flaws yet. PHP publishes fixes at 16:00 Dutch time; the Tweede Kamer and KNMP sites are offline.

de Volkskrant (opens in a new tab) · metronieuws.nl (opens in a new tab) · nd.nl (opens in a new tab) · zeelandnet.nl (opens in a new tab) · pcnews.ru (opens in a new tab) · savonsanomat.fi (opens in a new tab) · dekrantenkoppen.be (opens in a new tab)

DigiD and MijnOverheid are offline as a precaution, NOS reports, along with RTL.nl and Tweakers. The National Cyber Security Centre's own website is also down.

NOS (opens in a new tab) · nd.nl (opens in a new tab) · metronieuws.nl (opens in a new tab) · geo.tv (opens in a new tab) · zeelandnet.nl (opens in a new tab) · kymensanomat.fi (opens in a new tab) · oozo.nl (opens in a new tab)

AD reports that 11 municipal websites in the Utrecht region, including Zeist, IJsselstein and Houten, are offline as a precaution over the PHP flaw.

AD.nl (opens in a new tab) · nieuws.nl (opens in a new tab) · metronieuws.nl (opens in a new tab) · news.nate.com (opens in a new tab) · straitstimes.com (opens in a new tab) · zeelandnet.nl (opens in a new tab) · mybroadband.co.za (opens in a new tab)

Cloudflare reports the first attacks exploiting the PHP flaws, De Morgen reports. The municipality of Vlissingen has taken its entire website offline as a precaution.

De Morgen (opens in a new tab) · AD.nl (opens in a new tab) · mybroadband.co.za (opens in a new tab) · independent.co.uk (opens in a new tab) · news.nate.com (opens in a new tab) · welingelichtekringen.nl (opens in a new tab) · oozo.nl (opens in a new tab) · zeelandnet.nl (opens in a new tab)

The municipality of Nieuwkoop has taken its website offline as a precaution over the PHP flaws, according to AD.

AD.nl (opens in a new tab) · news.nate.com (opens in a new tab) · independent.co.uk (opens in a new tab) · oozo.nl (opens in a new tab) · zeelandnet.nl (opens in a new tab) · agf.nl (opens in a new tab)

NOS reports that FC Twente, public transport operator EBS, the municipality of Zwolle and Notubiz are offline as a precaution over the PHP flaws.

NOS (opens in a new tab) · news.nate.com (opens in a new tab) · accountant.nl (opens in a new tab) · journaldugeek.com (opens in a new tab) · independent.co.uk (opens in a new tab) · excite.co.jp (opens in a new tab) · store.steampowered.com (opens in a new tab)

DPG Media, owner of De Morgen, has taken several of its websites offline as a precaution over the PHP flaws, its spokesperson Thijs van Soest says.

De Morgen (opens in a new tab) · nltimes.nl (opens in a new tab) · accountant.nl (opens in a new tab) · omroepdelft.nl (opens in a new tab) · nrc.nl (opens in a new tab) · engadget.com (opens in a new tab) · aamulehti.fi (opens in a new tab)

Radboud University says its website is offline as a precaution. In Rotterdam, Ikazia Hospital and the Port of Rotterdam are also down, AD reports.

AD.nl (opens in a new tab) · nrc.nl (opens in a new tab) · dagelijksestandaard.nl (opens in a new tab) · atmarkit.itmedia.co.jp (opens in a new tab) · markt.idowa.de (opens in a new tab) · 112-nu.nl (opens in a new tab)

Supermarket chain Hoogvliet has taken its website offline as a precaution over the PHP flaws, AD reports. Customers in the Groene Hart region cannot use the site for now.

AD.nl (opens in a new tab) · nd.nl (opens in a new tab) · vz.ru (opens in a new tab) · appleinsider.com (opens in a new tab) · en.hacks.gr (opens in a new tab) · jin115.com (opens in a new tab) · otakomu.jp (opens in a new tab) · hs.fi (opens in a new tab)

Brabant hospitals Jeroen Bosch, ETZ and Bravis have websites offline over the PHP flaw, AD reports.

AD.nl (opens in a new tab) · leidschdagblad.nl (opens in a new tab) · appleinsider.com (opens in a new tab) · yle.fi (opens in a new tab) · tap.info.tn (opens in a new tab) · news.yahoo.co.jp (opens in a new tab) · oxfordmail.co.uk (opens in a new tab)

Germany's CERT-Bund calls the PHP flaws, dubbed PHP2Shell (CVE-2026-109618, CVE-2026-109619), an acute emergency, Berliner Zeitung reports.

Berliner Zeitung (opens in a new tab) · telegraaf.nl (opens in a new tab) · us.headtopics.com (opens in a new tab) · bbc.co.uk (opens in a new tab) · discussions.wccftech.com (opens in a new tab) · tap.info.tn (opens in a new tab) · nownews.com (opens in a new tab) · medscape.com (opens in a new tab)

Flemish minister-president Matthias Diependaele says all Flemish government websites running PHP are being taken offline as a precaution. Belgium's VRT reports.

vrtnws.be (opens in a new tab) · tijd.be (opens in a new tab) · larazon.es (opens in a new tab) · nrc.nl (opens in a new tab) · bbc.com (opens in a new tab) · rijksoverheid.nl (opens in a new tab) · bloomberg.com (opens in a new tab) · lalibre.be (opens in a new tab)

Rotterdam's transit operator RET, the Rijnmond safety region, DCMR and Erasmus University are offline as a precaution over the PHP flaws, AD reports.

AD.nl (opens in a new tab) · nrc.nl (opens in a new tab) · nieuws.nl (opens in a new tab) · oozo.nl (opens in a new tab) · welingelichtekringen.nl (opens in a new tab) · handelsblatt.com (opens in a new tab) · tijd.be (opens in a new tab)

Belgian hospital AZ Monica in Antwerp, school platform Smartschool and Roularta Media's Knack.be and Libelle.be are offline as a precaution, NOS reports.

NOS (opens in a new tab) · ad.nl (opens in a new tab) · telegraaf.nl (opens in a new tab) · die-glocke.de (opens in a new tab) · tvkrasnodar.ru (opens in a new tab) · news.yahoo.co.jp (opens in a new tab) · nrc.nl (opens in a new tab) · thenews.com.pk (opens in a new tab)

Belgium's Centre for Cybersecurity (CCB) says it has no indications of cyberattacks in Belgium so far, while Flemish government sites stay offline.

vrtnws.be (opens in a new tab) · news.ru (opens in a new tab) · ad.nl (opens in a new tab) · sn.at (opens in a new tab) · arabic.pressbee.net (opens in a new tab) · drimble.nl (opens in a new tab) · wiwo.de (opens in a new tab) · stuttgarter-zeitung.de (opens in a new tab)

PHP has released its security update, earlier than the 16:00 Dutch time it announced, NOS reports. France and Finland have also taken government websites offline as a precaution.

NOS (opens in a new tab) · omropfryslan.nl (opens in a new tab) · life.ru (opens in a new tab) · nbcnews.com (opens in a new tab) · offnews.bg (opens in a new tab) · dhnet.be (opens in a new tab) · nd.nl (opens in a new tab) · news.nate.com (opens in a new tab)

The PHP Foundation, which maintains PHP, says it has no indications that hackers are exploiting the flaws, ANP reports.

vrtnws.be (opens in a new tab) · de Volkskrant (opens in a new tab) · fnnews.com (opens in a new tab) · redactie24.be (opens in a new tab) · pnp.de (opens in a new tab) · sueddeutsche.de (opens in a new tab) · oozo.nl (opens in a new tab) · mt.de (opens in a new tab)

Deventer, Zutphen, Apeldoorn, Almere and Meppel have also taken websites offline as a precaution, AD reports. AD says services largely continue.

AD.nl (opens in a new tab) · nrc.nl (opens in a new tab) · theglobeandmail.com (opens in a new tab) · oozo.nl (opens in a new tab) · boersennews.de (opens in a new tab) · drimble.nl (opens in a new tab) · latercera.com (opens in a new tab)

Thuringia's state government and Hesse's websites are offline as a precaution, dpa reports. The city of Dresden has also taken its website down.

Süddeutsche Zeitung (opens in a new tab) · N-tv (opens in a new tab) · webpronews.com (opens in a new tab) · drimble.nl (opens in a new tab) · boerse.de (opens in a new tab) · home.kingsoft.jp (opens in a new tab)

Dutch websites taken offline over the PHP flaw are slowly coming back online after PHP's security update, NOS reports.

NOS (opens in a new tab) · rijnmond.nl (opens in a new tab) · fashionica.com (opens in a new tab) · goodfellowsomaha.com (opens in a new tab) · ipsos.com (opens in a new tab) · pasadena.edu (opens in a new tab)

Belgium's federal government websites are also offline as a precaution, according to 7sur7.

7sur7 (opens in a new tab) · brusselstimes.com (opens in a new tab) · tijd.be (opens in a new tab) · nos.nl (opens in a new tab) · nieuwsblad.be (opens in a new tab) · vrt.be (opens in a new tab) · tvi.iol.pt (opens in a new tab) · dutchnews.nl (opens in a new tab)

Berlin's Charité hospital, the police Internetwache and the Berlin fire brigade have taken websites offline as a precaution. Charité says on X it is not a cyberattack.

Der Tagesspiegel (opens in a new tab) · rbb24.de (opens in a new tab) · tagesspiegel.de (opens in a new tab) · berlin.t-online.de (opens in a new tab) · tagesschau.de (opens in a new tab) · berliner-zeitung.de (opens in a new tab) · newstime.joyn.de (opens in a new tab)

Twenty of 21 municipalities in Southeast Brabant have taken their websites offline as a precaution, AD reports. Helmond is the only one still online.

AD.nl (opens in a new tab) · omroepbrabant.nl (opens in a new tab) · agconnect.nl (opens in a new tab) · brusselstimes.com (opens in a new tab) · nieuwsblad.be (opens in a new tab) · nltimes.nl (opens in a new tab)

Security.nl, one of the Netherlands' main IT news sites, is among the first to go offline as a precaution, Trouw reports.

Trouw (opens in a new tab) · ae.marketscreener.com (opens in a new tab) · tysol.pl (opens in a new tab) · pernambuconoticias.com.br (opens in a new tab)

The PHP Foundation says it found one of the two PHP2Shell flaws in 2024 but stalled for months over the fix. It calls the delay a structural failure.

The Next Web (opens in a new tab) · srf.ch (opens in a new tab) · dattelner-morgenpost.de (opens in a new tab) · pernambuconoticias.com.br (opens in a new tab) · economictimes.com (opens in a new tab) · article.auone.jp (opens in a new tab) · k.sina.com.cn (opens in a new tab) · tysol.pl (opens in a new tab)

Duisburg's city, utility, university and zoo websites are offline as a precaution, RP Online's test shows. Bochum's city has cut its web servers, RP Online reports.

RP Online (opens in a new tab) · sueddeutsche.de (opens in a new tab) · thisisthecoast.co.uk (opens in a new tab) · indiatoday.in (opens in a new tab) · zeelandnet.nl (opens in a new tab) · itsecuritynews.info (opens in a new tab) · tagesspiegel.de (opens in a new tab)

Mainz and Saarbrücken websites are offline as a precaution over the PHP flaw, dpa reports.

Süddeutsche Zeitung (opens in a new tab) · thenextweb.com (opens in a new tab) · rd.nl (opens in a new tab) · irishexaminer.com (opens in a new tab) · firstpost.com (opens in a new tab) · villamedia.nl (opens in a new tab) · stuttgarter-zeitung.de (opens in a new tab) · nzz.ch (opens in a new tab)

Public websites in Berlin, Brandenburg, and Switzerland are now offline as precautions against two PHP flaws continue across Europe, local media report.

thenextweb.com (opens in a new tab) · irishexaminer.com (opens in a new tab)

The US National Security Agency says organizations should update PHP-based websites, or take them offline if patching is not feasible.

ANSA.it (opens in a new tab) · Deutsche Welle (opens in a new tab) · RTP - Rádio Televisão Portuguesa (opens in a new tab) · ndtv.com (opens in a new tab) · 24heures.ch (opens in a new tab) · v.daum.net (opens in a new tab) · nrc.nl (opens in a new tab) · abcnews.com (opens in a new tab)

DPG Media says its websites and Smartschool are back online after the PHP security update, with no signs of incidents so far.

De Morgen (opens in a new tab) · cnbc.com (opens in a new tab) · v.daum.net (opens in a new tab) · news.nate.com (opens in a new tab) · linternaute.com (opens in a new tab) · kenyans.co.ke (opens in a new tab) · ria.ru (opens in a new tab) · iz.ru (opens in a new tab)

Websites of Flevoland's municipalities, including Dronten, Lelystad and Urk, are offline as a precaution, NOS reports.

NOS (opens in a new tab) · news24.com (opens in a new tab) · gaydio.co.uk (opens in a new tab) · independent.co.uk (opens in a new tab) · cyprus-mail.com (opens in a new tab) · article.wn.com (opens in a new tab) · geo.tv (opens in a new tab) · ctvnews.ca (opens in a new tab)

Albert Schweitzer hospital, DCMR and Veiligheidsregio Zuid-Holland Zuid are back online after PHP's update, NOS reports. RET and most Rijnmond municipalities remain offline.

NOS (opens in a new tab) · news24.com (opens in a new tab) · article.wn.com (opens in a new tab) · geo.tv (opens in a new tab) · independent.co.uk (opens in a new tab) · dailyrecord.co.uk (opens in a new tab) · news.nate.com (opens in a new tab) · gaydio.co.uk (opens in a new tab)

OpenAI says security firm Calif found one of the critical PHP flaws using an OpenAI AI model, according to VRT. AD reports 11 Utrecht-region municipal websites are back online.

vrtnws.be (opens in a new tab) · AD.nl (opens in a new tab) · diariolibre.com (opens in a new tab) · ua.news (opens in a new tab) · qz.com (opens in a new tab) · clarin.com (opens in a new tab) · muycomputer.com (opens in a new tab) · zonebourse.com (opens in a new tab)

Volkskrant reports the Autoriteit Persoonsgegevens and the network for Dutch higher education also took websites offline as a precaution.

de Volkskrant (opens in a new tab) · rijnmond.nl (opens in a new tab) · rtn.ch (opens in a new tab) · usnews.com (opens in a new tab) · abc.com.py (opens in a new tab) · arnnewscentre.ae (opens in a new tab) · cnbctv18.com (opens in a new tab) · timesofindia.indiatimes.com (opens in a new tab)

DigiD and MijnOverheid are back online, NOS reports, while the Dutch government site overheid.nl remains offline.

NOS (opens in a new tab) · volkskrant.nl (opens in a new tab) · cnbctv18.com (opens in a new tab) · uazmi.org (opens in a new tab) · oglobo.globo.com (opens in a new tab) · moneycontrol.com (opens in a new tab) · article.wn.com (opens in a new tab) · oozo.nl (opens in a new tab)

The canton of Basel-Stadt says it has taken its cantonal websites offline as a precaution over the PHP flaw. It has registered no security incident so far.

SWI swissinfo.ch (opens in a new tab) · lfm.ch (opens in a new tab) · ctvnews.ca (opens in a new tab) · kn-online.de (opens in a new tab) · ankaramasasi.com.tr (opens in a new tab) · information.tv5monde.com (opens in a new tab) · gandul.ro (opens in a new tab) · timesofindia.indiatimes.com (opens in a new tab)

The BBC says its own website and Edinburgh City Council's site are offline as a precaution over the PHP flaws.

BBC (opens in a new tab) · defenseromania.ro (opens in a new tab) · devdiscourse.com (opens in a new tab) · thewest.com.au (opens in a new tab) · timesnownews.com (opens in a new tab) · newsy-today.com (opens in a new tab) · bastillepost.com (opens in a new tab) · investmentnews.com (opens in a new tab)

Spain's Ministry of Digital Transformation urges all public and private entities to update PHP immediately, El Mundo reports.

EL MUNDO (opens in a new tab) · techrepublic.com (opens in a new tab) · thewest.com.au (opens in a new tab) · timesnownews.com (opens in a new tab) · newsbytesapp.com (opens in a new tab) · breitbart.com (opens in a new tab) · n.news.naver.com (opens in a new tab) · dnyuz.com (opens in a new tab)

The University of Barcelona has cut its internet connections, and its Campus Virtual is temporarily down, according to El Periodico.

El Periódico (opens in a new tab) · n.news.naver.com (opens in a new tab) · vilaweb.cat (opens in a new tab) · article.wn.com (opens in a new tab) · hechoencalifornia1010.com (opens in a new tab) · inewsgr.com (opens in a new tab) · news.sbs.co.kr (opens in a new tab)

Groningen province, several municipalities and FC Groningen took websites offline over the PHP flaws; they are slowly coming back online, NOS reports.

NOS (opens in a new tab) · mirror.co.uk (opens in a new tab) · latimes.com (opens in a new tab) · pk.headtopics.com (opens in a new tab) · afr.com (opens in a new tab) · security.nl (opens in a new tab) · article.wn.com (opens in a new tab) · nissewaard.nl (opens in a new tab)

The Interior Ministry says it is unclear when overheid.nl will be back online; the 113 and Meld Misdaad Anoniem sites are also still down, NOS reports.

NOS (opens in a new tab) · latimes.com (opens in a new tab) · news.nate.com (opens in a new tab) · pk.headtopics.com (opens in a new tab) · kp.ru (opens in a new tab) · n.news.naver.com (opens in a new tab) · italiatelegraph.com (opens in a new tab) · berliner-zeitung.de (opens in a new tab)

Denmark has also taken some government websites offline as a precaution, Reuters reports.

engadget (opens in a new tab) · latimes.com (opens in a new tab) · theverge.com (opens in a new tab) · gencgazete.net (opens in a new tab) · twaslnews1.twaslnews.com (opens in a new tab) · pink.rs (opens in a new tab) · iha.com.tr (opens in a new tab) · perthnow.com.au (opens in a new tab)

PHP's project says no configuration change fully protects against the two flaws, so only updating to the fixed versions helps, El Mundo reports.

EL MUNDO (opens in a new tab) · mkfm.com (opens in a new tab) · washingtontimes.com (opens in a new tab) · bostonherald.com (opens in a new tab) · moroccoworldnews.com (opens in a new tab) · foxbaltimore.com (opens in a new tab) · n.news.naver.com (opens in a new tab)

Many Thuringian state websites are back online after the PHP update, dpa reports, including the state chancellery, state police and interior ministry.

N-tv (opens in a new tab) · dw.com (opens in a new tab) · gazetadopovo.com.br (opens in a new tab) · oozo.nl (opens in a new tab) · v.daum.net (opens in a new tab) · n.news.naver.com (opens in a new tab) · kazan.bezformata.com (opens in a new tab)