Image
Cybercrime file image
– Credit: Rendering: www.elbpresse.de / Christoph Scholz /
Flickr / Wikimedia Commons
– License: CC-BY-SA
Tech
National Cyber Security Centre
The National Cyber Security Centre
government websites
tech
Dozens of Dutch government websites remain vulnerable on outdated PHP software
Saturday, 24 October 2026 – 13:55
Dozens of government websites, including those belonging to ministries, provinces, and municipalities, remain vulnerable because they continue to run on outdated versions of PHP web development software. This conclusion emerged from a simulation conducted byBNR with the assistance of Assetnote, a tool capable of detecting PHP-related vulnerabilities. Of the more than 900 municipal websites examined, more than 50 remain vulnerable. The news outlet said this places the municipal sites among the most vulnerable of all government websites reviewed.
In all the cases reviewed, the affected pages are not the primary homepages of these government entities but rather secondary pages addressing asylum matters, tourism information, or sustainability subsidies. BNR has refrained from disclosing the specific pages so that ill-meaning actors cannot exploit the gaps. BNR has also shared the affected websites with the National Cyber Security Centre (NCSC) to enable improved protection.
The NCSC responded that it “strongly” advises organizations to “implement updates as soon as possible,” because “vulnerable systems face a risk of misuse.” The center is reportedly also conducting its own investigation to determine whether the gaps have already been exploited, warning that “the situation could deteriorate rapidly.”
BNR has also shared the list of vulnerable websites with the Association of Dutch Municipalties (VNG). In a statement, the VNG indicated that municipalities must individually determine which measures are required for their websites.
“Municipalities possess the information and recommendations from the NCSC necessary to implement the required security updates. They are aware of the urgency and are working diligently to eliminate the risks as quickly as possible. The Information Security Service of the VNG supports municipalities in this effort,” the organization told the news outlet.
On Wednesday, a number of websites belonging to governments, companies, and other organizations went offline as a precaution after two major vulnerabilities were discovered in PHP. Later that day, a patch was released that was intended to resolve the issue, but it does not automatically update sites still running older versions. Those sites remain vulnerable, the news outlet reports.
