Major PHP security flaws force Dutch government, DigiD and education websites offline

THE HAGUE — Several Dutch government agencies, businesses and educational institutions have taken websites and systems offline as a precaution after two serious security vulnerabilities were discovered in the PHP programming language.

Affected services include MijnOverheid.nl, DigiD, the Dutch Parliament, the National Cyber Security Centre (NCSC) and the Dutch Data Protection Authority. RTL, Tweakers and higher education systems have also been affected.

The vulnerabilities could allow hackers to infiltrate systems, execute malicious code and potentially steal users' personal information.

Cybersecurity company Cloudflare has already detected attempted attacks, although the NCSC has not confirmed active exploitation. Authorities are urging organizations to update PHP as soon as a security fix becomes available.