Dutch NCSC Takes Its Main Website Offline Over PHP Vulnerabilities
The Dutch National Cyber Security Centre (NCSC) has taken its main website, NCSC.nl, offline temporarily as a precaution because of vulnerabilities in PHP, the server-side scripting language many sites run on. The notice appears on the agency's news page and is dated 21 October 2026. It does not say when the site will return.
While the main site is down, the NCSC is directing visitors to advisories.ncsc.nl for current information. For news and updates, it points people to its LinkedIn page and to the NCSC Community site.
The same day, the Dutch parliament website was also taken offline as a precaution. According to NL Times, the step followed a cybersecurity warning about newly disclosed PHP vulnerabilities. The two actions appear to share a trigger.
The NCSC said it had not yet detected any active exploitation of the newly disclosed PHP vulnerabilities. For most administrators, a disclosed flaw without observed exploitation is a patching priority rather than an incident response case. The NCSC has not, in the reporting available, tied its statement to a specific PHP branch or release, so teams should work from the advisories themselves rather than from secondary summaries.
The NCSC describes itself as the central information hub and expertise centre for cybersecurity in the Netherlands. Its vulnerabilities database, at vulnerabilities.ncsc.nl, carries individual CVE entries (Common Vulnerabilities and Exposures identifiers, the standard IDs for publicly known flaws). One of them concerns CVE-2023-48795, a libssh vulnerability whose described fix is improved memory handling. That entry concerns libssh, not PHP, and is not part of the current disclosure.
The broader context here is operational. When a national CERT takes its primary website offline, the practical question for downstream users is where guidance continues to flow. The NCSC has answered with a separate advisory domain and with social and community channels. Organisations that subscribe to NCSC feeds through the main site need to check whether their tooling still resolves and whether their RSS or email subscriptions have moved.
In my view, the detail worth noting is the separation between the advisory service and the public website. Patch guidance on its own domain does not depend on the main site returning, which is a practical advantage for anyone who needs to act on the warning this week. Whether the precaution turns out to be proportionate will depend on what the advisories say about affected versions and on whether exploitation is observed in the coming days.
For operators running PHP in production, the immediate steps are the ordinary ones: confirm which PHP versions and extensions are in use, check the NCSC advisories for the affected range, and apply vendor patches where they exist.
The decision to take two of the country's most visible government sites offline suggests the agency regards the disclosure as serious enough for a visible response, even without confirmed exploitation. That is an inference from the closures, not a statement from the NCSC.
