The Dutch National Cyber Security Center (NCSC) and the Belgian Centre for Cybersecurity have reportedly taken their public-facing websites offline in response to a newly discovered vulnerability in PHP. PHP is a widely used open-source scripting language commonly employed for web development and powering content management systems like WordPress and Drupal. The decision to take these sites offline is a proactive measure intended to prevent potential exploitation while administrators work to patch the underlying software.
Commenters on Hacker News noted that this is not an isolated incident, observing that numerous other platforms—including OBS, TicketTailor, and various wikis—have also gone offline to mitigate the risk. The discussion highlighted that the vulnerability appears to be a remote code execution (RCE) flaw, which could allow an attacker to run arbitrary commands on a server. One commenter pointed out that while some organizations are using Web Application Firewalls (WAFs) to provide a temporary stopgap, the primary recommendation remains patching the PHP environment itself.
The situation has sparked debate regarding the security posture of government agencies and the risks of using aging software. Some participants argued that the use of platforms with long-standing security issues by cybersecurity centers is a significant oversight. Others questioned the timing of the vulnerability disclosure, suggesting that a coordinated background patch with major distributors might have been preferable to a public release that reveals the exploit. Additionally, some users noted that even sites using static site generators may be affected if those sites are pre-rendered by a PHP engine before being served to the public.