PHP releases two security patches after Dutch sites go offline
PHP's developers released two patches on Wednesday afternoon for critical flaws in the language behind about 70% of websites, and site administrators are urged to install them so that DigiD, MijnOverheid and other services taken offline can return.
The developers of PHP made two security patches available on Wednesday afternoon, after the website of the Tweede Kamer, the House of Representatives, DigiD and MijnOverheid had been taken offline as a precaution. Site administrators have been urgently advised to install the patches as soon as possible, and many sites are expected to come back online afterwards.
NotuBiz, the website service that municipalities, provinces and water boards use to publish messages, is also offline. So are parts of the SURF network, the computer network of universities, colleges, vocational schools, academic hospitals and research institutions.
PHP announced on Tuesday that it had found two critical vulnerabilities and would publish the update at 16:00 on Wednesday. Roughly 70% of websites worldwide run on PHP or on applications built on it.
EU cybersecurity authorities warned on Wednesday morning that this could happen. CERT-EU advises organisations to install updates as soon as they are available. Where that is not possible, it advises switching off internet-connected applications until the updates can be installed.
Not all sites may return at once. Corine Schipper-Derkse of the NCSC, the national cyber security centre, said: "Some websites can flip a switch, but for other websites it can take longer, depending on which version they use." She said it can take minutes or hours in some cases, but longer in others, and a further patch could follow if the first does not solve every problem.
The NCSC has not seen active exploitation so far, and the PHP Foundation says it has no indication of it. Dane Knecht of the cyber security firm Cloudflare says hackers are already trying to exploit the vulnerabilities.
More on digital, tech and privacy
Guide: DigiD: how to get it, the app and the ID check, from abroad, without a Dutch passport
Follow the story: NCSC
NotuBiz
NotuBiz is an online platform that Dutch municipalities, provinces and water boards use to publish council documents, meeting agendas and official announcements. It is the service where residents can find the public messages and records of these local and regional governments. When it is offline, those publications cannot be read or updated.
SURF
SURF is the ICT cooperative of Dutch universities, universities of applied sciences, vocational education institutions, academic hospitals and research institutions. It provides shared digital services to these members, including the SURF network, the national network that connects them to the internet and to each other.
CERT-EU
CERT-EU is the Computer Emergency Response Team for the institutions, bodies and agencies of the European Union, based in Brussels. It monitors cyber threats and issues warnings and advice on security vulnerabilities and how to fix them. Its guidance is aimed at EU organisations and is not specific to the Netherlands.
NCSC (Nationaal Cyber Security Centrum)
The NCSC is the Dutch national cyber security centre, the government body that monitors digital threats and advises organisations and citizens on how to protect their systems. It also helps coordinate the response when serious security incidents affect Dutch websites, companies or public services. Its guidance is the reference point many Dutch organisations follow when dealing with software vulnerabilities and attacks.