DigiD and MijnOverheid go offline for hours over PHP flaws

Two serious vulnerabilities were found in PHP, a programming language that runs behind the scenes of many websites. On Wednesday many sites took themselves offline for hours as a precaution. DigiD, the login used for government services, and MijnOverheid, the government's personal portal, were also unreachable for hours.

PHP is the software that lets visitors log in to a website, place an order or look up information, though most users never notice it.

Vaisha Bernard, chief hacker at the cybersecurity firm Eye Security, says a small error crept into PHP about twenty years ago. "It was such a small mistake that it had not been discovered until now." He says AI makes finding such flaws faster and easier: about 20,000 have been discovered in 2026 so far. Attackers have also become more professional, he says: "Twenty years ago they were amateurs, now they are almost companies."

Matthijs van Amelsfort, director of the National Cyber Security Centre (NCSC), says AI speeds up cyberattacks and shortens the time available to close a hole. Both he and Bernard expect such incidents to happen more often. "Society is becoming even more digital, and with that the chance of a disruption grows," Van Amelsfort says.

Van Amelsfort urges companies to get their cybersecurity in order and to agree arrangements with their IT supplier beforehand. "If this happens in the middle of the night, who can you call and who does what?" he says.