Several Dutch government websites, including overheid.nl and the site of Meld Misdaad Anoniem, were still unreachable after operators took them offline as a precaution following the discovery of security flaws in the programming language PHP. According to NOS Tech, the disruption also hit government websites in Belgium, Finland, Germany and France, and services in Belgium and France were still affected at the time of reporting.
What happened
PHP is a programming language used to build websites, apps and software. NOS Tech reports that about 70 percent of all websites worldwide use PHP or a variation of it. That reach explains why so many sites went offline at the same time, in the Netherlands and abroad.
The PHP Foundation is the American organisation behind the language. According to NOS Tech, it announced in advance that it would release a security update. Hackers then used that announcement to try to locate the vulnerability and share information about it. NOS Tech notes that this information could have been used to break into websites built on PHP and steal customer data. Many organisations chose to take their sites offline until they could install the fix.
The PHP Foundation released the security update at 16:00, after which websites could safely restart. Many came back online fairly quickly, but not all of them. NOS Tech reports that the websites of 113, the suicide prevention line, and Centrum Seksueel Geweld stayed offline until late in the evening and returned during the night. Overheid.nl, the central portal for Dutch government information, was still down. A spokesperson for the Ministry of the Interior and Kingdom Relations told NOS it was not yet clear when the site would be available again. Some organisations need more time to update their systems.
Local government was hit as well. More than one hundred municipalities, provinces and water boards use the council information system Notubiz to publish official letters and documents. The Notubiz website itself was online, but not every part of it worked for its government clients. According to NOS Tech, official documents from the municipalities of The Hague, Almere, Breda, Haarlem, Den Bosch and Delft, and from the provinces of Overijssel, Gelderland and Friesland, could not be viewed. Notubiz planned to test the updates that evening and expected all pages to be available again the next morning.
The background goes back some time. The PHP Foundation writes on its own website that there were signs of a problem with PHP as early as 2024, but other, more concrete problems overshadowed them. NOS Tech reports that researchers at the security company Calif, working with OpenAI, found the first vulnerability on 11 August using a dedicated AI model. Wiz, a security company owned by Google, found the second on 24 August.
Why it matters for internationals in the Netherlands
Government services you rely on. Many internationals depend on Dutch government websites for practical information, and overheid.nl is one of the main entry points. When it goes down, finding official information becomes harder, especially for people who are still learning how the Dutch system works. The Notubiz outage matters too. If you live in The Hague, Almere, Breda, Haarlem, Den Bosch, Delft or one of the affected provinces and wanted to read council documents during this period, you could not access them online. This incident shows how much public information runs on a small number of shared technical systems.
Support lines. The temporary loss of the websites of 113 and Centrum Seksueel Geweld is a reminder that support services can also be affected by technical problems. NOS Tech reports that both sites were back online during the night. If you or someone you know relies on these services, it is worth knowing they have contact routes besides their websites.
Your data. The main risk NOS Tech describes is that attackers could have entered websites built on PHP and stolen customer data. Because PHP runs such a large share of the web, that could include online shops, booking platforms and service providers that internationals use every day. The reassuring part is that, according to the PHP Foundation, there are so far no signs that the vulnerabilities were used to attack companies through their websites. The Dutch National Cyber Security Centre (NCSC) and the American agency CISA both say they have not seen active exploitation. Taking sites offline was a precaution, not a response to a confirmed breach.
A European pattern. Government websites in Belgium, Finland, Germany and France were also unavailable, and Belgium and France were still affected at the time of the NOS report. For internationals who deal with authorities in more than one EU country, such as cross-border workers or people with ties to a home country, the disruption may have reached beyond the Netherlands.
AI and security work. The first flaw was found by Calif working with OpenAI, using a specialised AI model. For people working in or moving into the Dutch tech sector, this is a concrete example of AI being used to find vulnerabilities in core software that much of the internet depends on. The incident also shows how important patch management and fast response are for organisations running PHP, which covers a large share of web development teams.
What to watch next
The first thing to watch is when overheid.nl comes back. The Ministry of the Interior and Kingdom Relations has not given a date. The second is whether Notubiz restores full access to municipal and provincial documents the next morning, as it expected.
Beyond the Netherlands, it remains to be seen how quickly government websites in Belgium and France come back online. Watch also for any updates from the NCSC, CISA or the PHP Foundation. For now all three say they have seen no misuse, and any change to that would matter to anyone who has an account with a PHP-based service.
Finally, the way this vulnerability became public raises a question. NOS Tech reports that hackers used the advance announcement of the update to hunt for the flaw. How software organisations communicate about upcoming security fixes may come under closer review after this episode.
Source: NOS Tech
Sources
- NOS Tech: Nog altijd websites niet bereikbaar na lek, ook internationaal nog problemen, accessed 22 October 2026
The Netherlands, for internationals
One email a week: the week's news for internationals in the Netherlands, new practical guides and what changed in the cities. No spam, unsubscribe any time.
