Dutch hospitals take websites offline after PHP vulnerability warning

Several Dutch hospitals took their websites offline on Wednesday after a warning about vulnerabilities in PHP, the programming language used to run websites. Others kept their homepages available but disabled some services, Dutch news agency ANP reported.

The sites of Maastricht UMC+, Jeroen Bosch Hospital, BovenIJ and Albert Schweitzer Hospital were unreachable. Visitors to the websites of Haaglanden Medical Centre, St Antonius Hospital and Elisabeth-TweeSteden Hospital instead saw an error message.

Bravis Hospital said it had temporarily put its systems into maintenance mode as a precaution because of the PHP2Shell vulnerability. Franciscus Hospital disabled its online patient leaflets, citing national security risks. At Gelre Hospitals, the Patient Journey App was unavailable while its suppliers updated security measures.

The European Commission has separately said it has no indication that its services or data were affected by a PHP vulnerability, while its security teams apply available updates. Its response to the warning does not establish whether the Dutch hospitals’ systems were affected.