Severe Security Flaws In Major Web Language Force Dutch Public Outages

2026-10-22 digital

The Hague, Thursday 22 October 2026
Critical, decade-old vulnerabilities discovered in PHP via advanced AI models forced major Dutch public infrastructure and government services offline this week, triggering emergency European cyber-defense protocols to mitigate widespread operational risks.

Widespread Outages Across Dutch Digital Infrastructure

On Wednesday, 21 October 2026, severe vulnerabilities in PHP—a ubiquitous programming language driving an estimated 70% of all global websites—compelled public institutions and private platforms across the Netherlands to pull services offline as a precautionary measure [1][2][8]. Rated 9.2 out of 10 for severity, the security flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow remote code execution via a simple POST request [1][8]. Affected entities included critical state channels such as the Dutch Parliament (Tweede Kamer), DigiD, MijnOverheid, and the National Cyber Security Centre (NCSC) website [2][3][8]. Additionally, healthcare providers including Maastricht UMC+, BovenIJ, and Jeroen Bosch Ziekenhuis temporarily restricted access, alongside public transport hubs like Schiphol Airport, municipal platforms using NotuBiz software, and commercial brands [2][7].

AI Discovery and Legacy Code Vulnerabilities

The flaws had remained undetected within the PHP codebase for over a decade before cybersecurity research firm Wiz uncovered them using advanced artificial intelligence auditing models [1][2]. According to Wiz, AI auditing has altered cyber defense timelines, allowing a single researcher using automated models to achieve in one week what previously required months of dedicated human analysis [2][4]. The PHP Foundation acknowledged that while suspicions regarding potential vulnerability exploitability surfaced in 2024, resolution was hindered by internal decision-making processes and resource limits [2][3]. The foundation noted that this delay represented a structural failure within its operational framework [2][3].

Remediation Dynamics and Long-Term Systemic Risk

While platforms such as DPG Media, RTL Nieuws, and several political party websites began restoring access following the release of official updates, recovery across the broader digital economy remains fragmented [2][3]. Tech integration providers note that applying a software patch does not automatically ensure operational integrity, as organisations must verify whether unauthorized access occurred prior to the fix [3][4]. Network provider SURF anticipated full availability across higher education infrastructure by Thursday morning, 22 October 2026, while key administrative platforms remain subject to lingering review processes [2][3].

Sources & Ecosystem Partners

Cybersecurity Infrastructure