Dutch Parliament website disabled after PHP security alert

The Dutch Parliament’s House of Representatives, the Tweede Kamer, disabled its website on Wednesday 21 October after CERT-EU, the European Union’s cybersecurity service, warned of two critical vulnerabilities in PHP. A Tweede Kamer spokesperson said the site was taken offline as a precaution against possible exploitation.

The Dutch National Cyber Security Centre, or NCSC, said it had not detected active exploitation of the vulnerabilities that morning. The agency urged organisations operating publicly accessible PHP systems to assess their exposure and consider taking systems offline until updates were available. PHP developers released two emergency patches later that day.

The NCSC said restoration times would depend on the software versions and technical requirements of individual systems. It said some sites could return within minutes while others could take hours or longer. Fortuna Sittard, police union ACP, the Royal Dutch Pharmacists Association, public transport operator EBS and parts of a shared network used by Dutch universities, vocational institutions, academic hospitals and research organisations were also affected.