Websites return after PHP security update, but risks remain, Dutch centre warns

Websites taken offline across the Netherlands as a precaution over critical vulnerabilities in PHP are gradually returning, but the Dutch National Cyber Security Centre (NCSC) warns that securing all affected systems will take time.

A software update to fix the vulnerabilities became available at about 4pm on Wednesday. Several websites came back online after installing it, including RTL Nieuws, tech site Tweakers and sites belonging to several political parties. How easily operators can apply the update depends on their systems’ settings and links to other services, an NCSC spokesperson said.

The centre urged organisations to check their systems and install the update as soon as possible. Systems that have not been updated should remain offline as a precaution, it said.

Because PHP is widely used across many kinds of products, the NCSC expects it will take time for most vulnerable systems to be updated. Upgrading older versions may also take time and have an impact. The centre warned that this could leave a prolonged period in which attackers may identify vulnerable systems and organisations and carry out digital attacks.

Earlier on Wednesday, several government websites were taken offline as a precaution after two PHP vulnerabilities were reported. The government said at the time that it had seen no signs of active exploitation, and that many central-government websites do not use PHP.