Why DigiD, MijnOverheid, and other websites went offline today
Two critical PHP vulnerabilities put many public websites at risk. Here is what happened, why services were taken offline, and what website owners need to do now.
Omar Geerman
On 21 October 2026, several well-known Dutch websites suddenly went offline. DigiD, MijnOverheid, Overheid.nl, and the website of the National Cyber Security Centre were among the services temporarily unavailable. The immediate cause was not a confirmed breach, but the discovery of two critical vulnerabilities in PHP, the programming language that powers a large part of the web.
Going offline was not a failure in this case. It was a deliberate security measure.
What is PHP, and why did this affect so many websites?
PHP runs on the server and handles tasks such as forms, logins, payments, and database requests. It is used by custom applications and popular content management systems. A vulnerability in PHP itself can therefore affect many different websites at once, even when their own application code has been built carefully.
Two flaws that could allow server takeover
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both received a CVSS score of 9.2. They can allow an attacker without an account to execute their own code remotely on a server. This is known as remote code execution and is one of the most serious classes of security vulnerability.
- CVE-2026-109618 abuses error handling when PHP runs out of available memory during a request.
- CVE-2026-109619 can cause stale internal data from an earlier request to be used again after its backing memory has been released.
- The PHP Security Team says all PHP installations serving web requests are at risk; for Apache with mod_php, a demonstrated exploit can trigger before application code runs.
Why were public services taken offline?
Before security updates were available, administrators could not eliminate the risk completely. The NCSC therefore advised organisations to assess each internet-facing PHP system and, where necessary, temporarily disable it. For services handling sensitive personal data, being unavailable for a short period was safer than risking an attacker gaining access to the server.
The Dutch government reported that Overheid.nl, MijnOverheid.nl, and DigiD were among the sites taken offline as a precaution. Other public bodies, educational institutions, and commercial websites also acted. Their simultaneous outages do not mean they were all breached; many organisations deliberately reduced their exposure before an attack could occur.
Was personal data stolen?
At the time of publication, the NCSC had seen no signs of active exploitation. Public proof-of-concept code was available, however, making rapid action essential. Not seeing abuse is not proof that no abuse occurred anywhere. Organisations should therefore patch and also examine their logs and systems for unusual behaviour.
Security updates are now available
The PHP Security Team has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These versions fix both critical vulnerabilities. PHP 8.1 and older no longer receive regular support from the PHP project. Some Linux distributions and long-term support vendors provide their own backports; otherwise, upgrading to a supported release is necessary.
What website owners should do now
- Inventory every public website, API, and administration system that uses PHP.
- Check the PHP version and how PHP handles incoming web requests.
- Install a patched PHP release or the security update supplied by your vendor immediately.
- Restart PHP workers and web servers as required, then test the most important user journeys.
- Review server, application, and access logs for unusual POST requests, errors, and process behaviour.
- Use temporary mitigations only as a bridge; the PHP team says updating is the only complete solution.
The wider lesson
This incident shows that continuity is not only about uptime. Sometimes a controlled interruption is the safest choice. Good operations means knowing which technology runs where, using supported versions, being able to deploy updates quickly, and deciding in advance who can take a service offline during a serious incident.
Sources
- PHP Security Team — Critical remote code execution vulnerabilities, update now
- NCSC — Critical vulnerabilities in PHP
- Dutch government — Websites taken offline as a precaution
- CERT-EU — Security Advisory 2026-018
Need help with a PHP website?
If you use WordPress, WooCommerce, or a custom PHP platform and are unsure whether the environment is secure and current, Geerman Web Solutions can check the PHP version and hosting, apply patches or a migration, test important user journeys, and assess whether log analysis is needed. Get in touch for a concrete review and clear next-step advice.