DigiD and MijnOverheid offline after critical PHP vulnerabilities
Websites and apps have been disabled as a precaution while a security update is being prepared.
Follow-up to: Attacks via PHP flaws reported, evidence remains limited Wednesday, 21 October 2026, 11:12
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
DigiD.nl, MijnOverheid.nl, the website of the Lower House (Tweede Kamer), RTL Nieuws and the Schiphol app were taken offline as a precaution on Wednesday because of two critical vulnerabilities in PHP. As a result, citizens cannot access MijnOverheid, while DigiD can, according to the latest information, still be used to log in to other services.
The measures were taken because the vulnerabilities make it possible to control a server remotely. The DigiD website and MijnOverheid cannot be reached. The Schiphol app no longer displays up-to-date flight information; Schiphol is directing travellers to its website. Websites belonging to several hospitals, provinces, educational institutions and public organisations have also been temporarily disabled.
The Lower House also took its website offline. According to a spokesperson, the vulnerabilities could potentially allow malicious actors to gain control of a server. RTL disabled both its website and app and says it is carrying out an urgent security update. Schiphol’s website is reportedly still accessible.
For users, the measure mainly means that MijnOverheid is temporarily inaccessible and that the DigiD website is unavailable. According to the latest public information, the DigiD login function itself continued to work at various affiliated organisations. Logius, the operator of these services, has not reported a separate, confirmed restoration time for DigiD and MijnOverheid.
The National Cyber Security Centre says it has not seen any active exploitation of the vulnerabilities. At the same time, the NCSC considers every publicly accessible system using PHP to be potentially vulnerable until it has been updated. Organisations can therefore quickly install the patch after their own risk assessment or temporarily take their website offline.
The PHP organisation had announced the security update for Wednesday 21 October at 14:00 UTC, 16:00 Dutch time. At 15:26 Dutch time, the release was still listed as forthcoming on the official PHP website. It had therefore not yet been confirmed when Dutch websites and apps would come back online.
It had previously become known that two critical PHP vulnerabilities had been discovered worldwide. Both were given a CVSS score of 9.2. PHP advised users to prepare for the update, but according to the announcement would publish the technical details and fixed versions only when the release went live. The first Dutch organisations consequently decided to disable their public systems as a precaution. This in itself is not evidence that these organisations had been breached.
Also show where in Europe and in the world
One story, several perspectives
What is established
- Two critical vulnerabilities in PHP led to precautionary measures at many Dutch organisations.
- The NCSC reported no active exploitation but warned that publicly accessible PHP systems could be vulnerable.
- The official patch was scheduled for 21 October at 16:00 Dutch time.
- Taking websites offline limits the risk but temporarily obstructs public services.
Left
Arguments Public digital services must provide maximum security, even if this causes temporary inaccessibility. Governments should invest in modern, well-maintained infrastructure and should not make citizens dependent on vulnerable systems.
Values Equal access, public responsibility, privacy and protection from digital harm.
Consequences Precautionary measures may particularly affect people who are entirely dependent on digital government services; alternatives and clear communication are therefore needed.
Centre
Arguments Taking systems offline is defensible as long as the risk assessment justifies it, but organisations must properly coordinate patching processes, continuity and communication.
Values Proportionality, expert risk management and reliable public services.
Consequences A temporary outage is acceptable if it prevents a larger incident, but recovery and evaluation should follow quickly.
Right
Arguments Governments and companies must be responsible for their own digital security and must not make citizens unnecessarily dependent on centralised systems. Closing a website is understandable, but structurally postponing maintenance is unacceptable.
Values Individual responsibility, continuity, efficiency and resilience.
Consequences Prolonged outages can cause economic and administrative damage; organisations should therefore arrange redundant systems and clear accountability.
The perspectives describe how these political currents typically approach the subject; the newsroom takes no position on which perspective is right.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The core facts have been confirmed by NOS and the official PHP website. The text clearly distinguishes between precautionary measures, the absence of reported active exploitation and the update not yet having been released.
- confirmed DigiD.nl and MijnOverheid.nl were taken offline as a precaution. — NOS explicitly reports both services as offline. source
- confirmed The NCSC saw no active exploitation and warned that publicly accessible PHP systems were probably vulnerable. — NOS quotes the NCSC warning. source
- confirmed The PHP update was scheduled for 21 October at 14:00 UTC. — The official PHP website gives this release time. source
- confirmed DigiD remained usable for logging in at various affiliated organisations. — This is reported in the NOS live blog. source
- confirmed There was still no confirmed restoration time at 15:26. — The public sources consulted give no restoration time; the PHP website still lists the patch as forthcoming. source
Editor's note
The services taken offline, the precautionary measure, the NCSC warning and the scheduled release time have been confirmed. At 15:26, the patch had not yet officially been released and no restoration time had been confirmed. The public information contained no indication of a confirmed breach at DigiD or MijnOverheid.Sources
The story so far
- Wednesday, 21 October 2026, 08:13 PHP warns of two critical security vulnerabilities
- Wednesday, 21 October 2026, 11:12 Attacks via PHP flaws reported, evidence remains limited
- Wednesday, 21 October 2026, 15:27 DigiD and MijnOverheid offline after critical PHP vulnerabilities (this article)
More on this in Dutch media
- Trouw — „php digid”
- NU.nl — „php digid”
- De Telegraaf — „php digid”