Dutch parliament website taken offline as cybersecurity warning triggers precautions

The website of the Tweede Kamer, the lower house of Dutch parliament, has been temporarily taken offline as a precautionary measure following the discovery of vulnerabilities in PHP, the programming language used to build websites. A spokesperson confirmed the move when asked about it. Many other Dutch sites have also been taken down.

“These vulnerabilities affect websites worldwide and make it possible to remotely control a server,” the spokesperson said. “This could potentially allow malicious actors to gain control of the server.”

On Wednesday morning, the European Union’s cybersecurity service, CERT-EU, issued a warning about two “critical vulnerabilities” in PHP, a programming language used widely around the world. The developers behind PHP have disclosed the flaws, which could allow attackers to remotely operate servers and potentially take control of them.

Several other websites have also been taken offline temporarily, including those of Dutch football club Fortuna Sittard, police union ACP, the Royal Dutch Pharmacists Association (KNMP) and public transport company EBS.

Parts of the Netherlands’ shared IT network for higher education and research were also taken offline on Wednesday as a precaution. The affected network serves universities, universities of applied sciences, vocational colleges, academic hospitals and research institutes.

The National Cyber Security Centre (NCSC) said it had not yet detected any active exploitation of the newly disclosed vulnerabilities in PHP. However, it urged organizations to prepare in advance for security updates scheduled for release on Wednesday afternoon to ensure they can install the fixes as soon as possible.

The NCSC says PHP will release updates at 4 p.m. to fix the vulnerabilities. The release time could also be brought forward. “Apply these updates immediately as soon as they become available. Until then, any system containing PHP that is accessible from the public internet is likely to be vulnerable,” the agency warns.

In the meantime, the NCSC recommends that organizations assess the risks posed by each internet-connected system running PHP and determine whether further precautions are needed, including shutting down the system. The cybersecurity centre has also temporarily taken its own website offline as a precautionary measure.

PHP, or applications based on the programming language, is used by approximately 70 percent of websites worldwide.