Some important websites remain down after emergency shutdowns

Websites in the Netherlands are coming back online following emergency shutdowns. This follows the discovery of vulnerabilities in the programming language on which many government, hospital and news sites are built, including Dutch News.

The organisation behind PHP, one of the world’s most widely used programming languages, said on Tuesday it would patch two flaws in its code.

The announcement prompted hackers to search for the holes and begin trying to attack sites, which US cyber security firm Cloudflare said on Wednesday it was noticing and defending against.

Sites were then swiftly taken down, including the government’s digital ID system DigiD and its online services portal MijnOverheid, the website of parliament, the umbrella organisation for the water boards, and a tool used by local councils for storing documents and scheduling meetings.

Some important sites, like anonymous crime reporting site Meld Misdaad Anoniem and domestic safety reporting network Veilig Thuis, were still offline on Thursday morning.

Disruptions
Dutch media companies were hit – RTL’s news website and app went down, and broadcaster NPO shut down the system used to upload content to its streaming services.

Several hospitals also took their websites down, as well as charities such as KWF cancer fund and the Dutch Heart Foundation.

Schiphol airport’s app stopped showing live flight information, and benefits agency UWV took a tool people use to report sick or recovered offline.

The problem was not limited to the Netherlands – the Flemish, German, French and Finnish governments all took websites offline.

What happened
Two critical flaws in PHP’s programming language were discovered in August using AI models from OpenAI and Google.

Google-owned cybersecurity firm Wiz, one of the firms that reported the flaws to PHP, said that the vulnerabilities in PHP had existed for over a decade, and said they ranked “among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

PHP built fixes for the vulnerabilities into an update and said all companies using its code should install the update immediately. Prime minister Rob Jetten reiterated this call on social media.

Justice minister David van Weel said the fact that so many websites had been taken offline as a precaution “has an impact on our digital society”.

“Fortunately, there are currently no indications that the vulnerabilities are being actively exploited,” Van Weel stated through his spokesperson.

The National Cyber Security Centre said it had not seen any active hacks, and the PHP Foundation told news agency ANP it also had no indication of breaches.