Anyone who wanted to read local news or arrange something online with an organisation on Wednesday could run into an inaccessible website. The reason is two serious security vulnerabilities in PHP, the programming language on which many websites run. Administrators temporarily took websites offline to limit the risk of abuse.
Rolderpost temporarily offline
During a check at 18.19, Rolderpost still showed a message saying the website had been taken offline as a precaution. In that notice, the village paper says the issue is a problem in PHP, not a vulnerability that only applies to Rolderpost. According to that same message, there are no indications that the website has been taken over or that data has been exposed. The site will be available again once the required security update has been successfully installed.
The municipality of Aa en Hunze also reported on Wednesday that a number of online services were unavailable as a precaution because of a possible software leak. The municipal homepage itself was reachable during our check. The municipality emphasises that there are no indications that its website has been hacked.
The Drents Archief also warned of temporary problems. Suppliers took systems offline as a precaution, with consequences for searching collections and viewing archive documents digitally. According to the archive, this also affects the Geheugen van Drenthe and AlleKolonisten.nl.
As a precaution is not the same as hacked
PHP processes data for websites and web applications on the server, among other things. Because of the vulnerabilities, attackers could execute their own commands on vulnerable systems. The National Cyber Security Centre therefore advised administrators to weigh per system whether additional measures are needed, such as temporary shutdown.
A website that shows a maintenance notice is therefore not automatically hacked. Taking it offline can in fact be a precautionary measure, while waiting for a security update and checks by the administrator.
Updates now available
The PHP team released security updates on Wednesday. The NCSC reported at 15.50 that these were available and advises applying the updates. For visitors, that does not mean all websites will work again immediately, hosting companies and administrators must first install the updates and check their systems.
Rolde.nl remained accessible
Rolde.nl was not taken offline preventively on Wednesday and remained accessible. Which measures are needed depends on the situation of the website in question and the administrator's assessment. The fact that a website stays online does not in itself mean that it does not use PHP.
Status: Wednesday 21 October 2026, check of the mentioned homepages at 18.19. Accessibility may have changed since then. This check does not constitute an investigation into the security of the websites.
