Dutch Parliament website taken offline amid major cybersecurity Threat,

THE HAGUE--The website of the Dutch Parliament's House of Representatives, the Tweede Kamer, was among numerous websites taken offline on Wednesday, October 21, 2026, following an urgent cybersecurity warning concerning critical vulnerabilities in PHP, one of the world's most widely used website programming languages. Emergency security updates were released later in the day, but Dutch authorities warned that restoring affected websites could take several hours or longer.

The shutdowns followed an alert issued Wednesday morning by the European Union's cybersecurity service, CERT-EU, concerning two critical vulnerabilities that could allow cybercriminals to remotely access and potentially take control of website servers.

A spokesperson for the Tweede Kamer confirmed that its website had been temporarily disabled as a precaution to protect its systems from possible exploitation.

The security warning prompted a broader response across the Netherlands, with several public institutions, businesses and organizations temporarily taking their websites offline.

Among those affected were Dutch football club Fortuna Sittard, police union ACP, the Royal Dutch Pharmacists Association (KNMP) and public transport operator EBS. Portions of the country's shared information technology network supporting universities, vocational institutions, academic hospitals and research organizations were also disconnected as a precaution.

Even the Dutch National Cyber Security Centre (NCSC), the government agency responsible for advising organizations on digital threats, temporarily took its own website offline.

The vulnerabilities attracted particular concern because PHP is used extensively across the internet. According to the initial report, PHP or applications built using the programming language are present on approximately 70 percent of websites worldwide, making the potential exposure far greater than the Dutch websites affected by Wednesday's precautions.

The NCSC reported Wednesday morning that it had not detected active exploitation of the newly disclosed vulnerabilities. Nevertheless, the agency urged organizations operating publicly accessible PHP systems to assess their exposure and consider temporary shutdowns until the necessary security updates became available.

By approximately 4:00 p.m. Wednesday, PHP's developers had released two emergency patches designed to correct the vulnerabilities.

However, the availability of the fixes did not mean all websites could immediately resume operations.

NCSC Deputy Director Corine Schipper-Derkse explained that implementation times would vary depending on the software versions being used and the technical requirements of individual systems. While some websites could be restored within minutes, others could require hours or additional time.

She emphasized that installing the security updates was essential and that individual organizations remained responsible for determining whether their systems could operate safely.

Dutch cybersecurity officials also indicated that additional updates could become necessary if the initial patches failed to address all identified issues.

One factor complicating the response was that information about the vulnerabilities had circulated publicly before the fixes were ready. This created a period during which potentially vulnerable systems were exposed while administrators awaited the emergency updates.

The NCSC explained that the preferred approach is normally to coordinate the disclosure of software vulnerabilities with the availability of fixes, reducing opportunities for cybercriminals to exploit weaknesses before organizations can protect themselves.

The agency noted that cybersecurity authorities in other European countries were also responding to the situation.

The incident highlights the dependence of government institutions, public services and private businesses on widely used software systems, where a newly identified vulnerability can trigger precautionary shutdowns across multiple sectors.

Although the discovery prompted significant preventive measures, Dutch authorities did not report widespread panic. Instead, organizations were encouraged to evaluate their individual risks, install the patches promptly and restore services only when they could do so safely.

As of the Wednesday afternoon reports, no confirmed timetable had been announced for the restoration of the Tweede Kamer website or all other affected systems.

‍