DigiD and MijnOverheid offline due to PHP vulnerabilities: what happened and what you need to do
On Wednesday 21 October 2026, DigiD, MijnOverheid and a range of other organisations took their websites offline as a precaution. The cause is not an outage at a single provider, but two critical security vulnerabilities in PHP, the programming language that a large part of the web runs on. In this article you can read what is known so far, what it means for you as a user, and what to do if your own website or platform runs on PHP.
Two critical vulnerabilities in PHP are the reason DigiD, MijnOverheid and other sites went offline as a precaution. The security update is scheduled for Wednesday 21 October at 4:00 pm.
Does your website run on PHP? Prepare for the update now, ask your hosting provider about temporary protection, and install the update as soon as it is available. The full checklist is below.
What is going on
- On 20 October, the PHP security team announced two critical vulnerabilities, each with a severity score of 9.2 out of 10.
- DigiD, MijnOverheid, the House of Representatives and several municipalities, educational institutions and transport operators took websites offline as a precaution.
- Taking systems offline does not mean there has been a break-in. At around 1 pm, the NCSC had not yet seen any active exploitation.
- According to the announcement, the update will be released on 21 October at 2:00 pm UTC, which is 4:00 pm Dutch time.
- A WordPress or plugin update does not fix this: the issue is in PHP itself, on the server.
On Tuesday 20 October, the PHP security team published a pre-announcement from the PHP security team about two serious vulnerabilities. Both received a CVSS 4.0 score of 9.2 on a scale of 10. To prevent exploitation, the technical details, the CVE numbers and the affected versions have not yet been disclosed. They will follow together with the security updates.
According to reports, depending on the configuration, the vulnerabilities could allow an attacker to execute code remotely on a vulnerable server. That is the most severe category there is: anyone who can execute code on your server can, in principle, access everything on it. That is why many organisations chose not to wait and temporarily took their public websites offline until the update is available.
On Wednesday morning, the websites of DigiD and MijnOverheid, the House of Representatives, the Dutch Data Protection Authority, the NCSC, dozens of municipalities, hospitals, educational institutions and transport operators, among others, went offline. Availability may fluctuate during the day, as organisations check and restart systems step by step.
The timeline so far
- Tuesday 20 October
The PHP security team announces two critical vulnerabilities and advises everyone to prepare for an update.
- Wednesday 21 October, morning
Government services and other organisations take websites offline as a precaution, including DigiD and MijnOverheid.
- Wednesday 21 October, 4:00 pm
The scheduled release of the security updates, with details of the affected versions (2:00 pm UTC).
- Afterwards
Organisations install the update, check their systems and bring websites back online. This can take hours per organisation.
This article was written on 21 October 2026, before the update was released. Details such as CVE numbers and affected PHP versions will only follow after that. For the latest status, see the source: the announcements on php.net and the outage notices from the relevant service.
What it means if you use DigiD or MijnOverheid
According to Logius, which manages DigiD, it was mainly the DigiD website that went offline, while logging in with DigiD remained possible at several organisations. At the same time, users reported that they could not log in to some services. For the current status, check the Logius status page or the website of the organisation you want to log in to.
Your data is not automatically at risk. Taking a service offline is a precautionary measure to prevent abuse. You do not need to change your password as a matter of course. If you have something urgent to deal with, such as a tax return or an application with a deadline, try again later in the day.
Below you can see live whether the websites of DigiD, MijnOverheid and other organisations are currently reachable. For the broader background, including beyond government, read the overview of the PHP vulnerability of October 2026.
Loading the overview.
From an Appfront server, we measure whether the public homepage loads. We do not test logging in with DigiD. A page that only shows a maintenance message does not count as normally reachable. Is your own platform running on PHP and are you unsure? Have a developer take a look.
Around major outages, scammers often send messages with a link to "log in again" or "restore your account". Do not click on such links. Always go to the known web address yourself, such as digid.nl or mijnoverheid.nl.
What to do if your website runs on PHP
Many business websites, web shops and customer portals run on PHP, often without the owner knowing. WordPress, Drupal, Magento, Laravel and most traditional hosting packages use it. Even if you do nothing with the server yourself, it is wise to find out today where you stand.
- Map out what you have
Which websites, portals and internal systems run on PHP, and which of them are directly reachable from the internet? Don't forget test environments and old sites.
- Ask your hosting provider or administrator
Which PHP version is running, when will they install the update, and what temporary protection is in place until then, such as a web application firewall?
- Install the update as soon as it is available
As soon as possible after the 4 pm release. Note: updating WordPress or plugins does not replace updating PHP on the server.
- Then check for suspicious activity
Check the log files for unusual requests, new files or accounts. The UK's NCSC advises taking stock of PHP systems and checking them for suspicious behaviour.
Should you take your site offline as a precaution, as the government did? That depends on what is on the server. If your platform processes personal data, payments or provides access to internal systems, going offline temporarily or restricting access until the update is installed is defensible. A simple informational site without sensitive data can usually stay online, as long as you install the update straight away. The UK's NCSC also recommends applying the update as soon as it becomes available.
Why this happens more often, and how to be prepared
Critical vulnerabilities in widely used software are not unusual. What defines moments like this is how quickly you can act. Organisations that know which software they run, who maintains it and how fast an update can go live have an ordinary working day today. Organisations with outdated or poorly documented systems are under pressure right now.
Three things make the difference. An up-to-date overview of your systems and the versions they run on. A clear agreement with your hosting provider or developer on who installs updates and how quickly. And software that is not so outdated that an update breaks something. Read more about what software maintenance costs and when outdated software becomes a risk.
the severity score (CVSS 4.0, out of 10) of each of the two vulnerabilities, according to the PHP security team's announcement.
critical vulnerabilities in PHP, announced on 20 October 2026.
the scheduled time of the security update on 21 October (2 pm UTC).
Frequently asked questions
On the PHP vulnerabilities of October 2026 and what you need to do.
Why is DigiD offline?
DigiD, MijnOverheid and other government sites went offline as a precaution on 21 October 2026 because of two critical security vulnerabilities in PHP. According to Logius, it was mainly the DigiD website that went offline, while logging in remained possible at several organisations.
Has my data been leaked?
There is no indication of that. Taking systems offline is a precaution to prevent exploitation. At around 1 pm, the NCSC had not yet seen any active exploitation of the vulnerabilities.
Do I need to change my DigiD password?
No, that is not necessary as a rule. Do stay alert to messages that ask you to log in via a link, and always go to the known web address yourself.
When will everything be working again?
The PHP security update is scheduled for 21 October at 16:00 Dutch time. After that, organisations will install the update and check their systems, so the time at which services come back online may vary per service.
Does my website run on PHP?
Probably, if you use WordPress, Drupal, Magento, Laravel or a traditional hosting package. Your hosting provider or developer can tell you exactly which PHP version is running.
Is a WordPress update enough?
No. The vulnerability is in PHP itself, on the server. Updating WordPress or plugins does not replace the PHP update. Ask your hosting provider when they will update PHP.
Further reading
The PHP vulnerability of October 2026
Live overview of sites that are offline, the timeline and what you need to do.
Read more ChecklistHow to check your website
Find your PHP version and decide whether to go offline temporarily.
Read more GovernmentBuilding a DigiD integration
Log in with DigiD on your own platform, securely and in line with Logius requirements.
Read moreNot sure whether your platform is secure?
Appfront builds and maintains digital platforms for organisations ranging from start-ups to government. Want to know how your systems are doing and how quickly you could roll out an update like this? Schedule a conversation.