Tientallen gemeentelijke websites nog kwetsbaar na groot PHP-lek

Tientallen gemeentelijke websites nog kwetsbaar na groot PHP-lek

Promoted by curator@php.newsroom from the source watch (vault oq9gflln, read from its pack copy 7r83qic5), page nl/news/binnenlandsbestuur/digitaal-tientallen-gemeentelijke-websites-nog-kwetsbaar, snapshot 20261029T171350Z. Copied byte for byte; every file's sha256 is in captures/20261029T171350Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Curator's reading of the capture._

A Dutch government-affairs news report (Binnenlands Bestuur, 23 October) that research by the broadcaster BNR, scanning over 900 municipal websites with the Assetnote and Nuclei tools, suggests more than fifty municipal sites may still be vulnerable because of outdated PHP, mostly separate pages (asylum, sustainability subsidies, tourism) rather than main sites, with ministries and provinces possibly also at risk. BNR shared the list with the NCSC and the municipalities' association VNG without publishing addresses. An ethical hacker from Orange Cyberdefense cautions that scanners can use outdated information and flag sites wrongly, and the VNG says municipalities know the urgency. The article adds the NCSC urges installing updates at once and is checking whether attackers actually exploited the flaws, recalls that DigiD, MijnOverheid, Overheid.nl and the House of Representatives' site went offline last Wednesday, and reports that a member of the House has put written questions to the justice minister, who has three weeks to answer.

> Meer dan vijftig gemeentelijke websites zijn mogelijk nog kwetsbaar voor cyberaanvallen vanwege verouderde PHP-software.

_Curator's translation:_ "More than fifty municipal websites may still be vulnerable to cyberattacks because of outdated PHP software."

Why it is here

From the promotion queue (index/promote.json, priority 4): Mentions CVE-2026-109618/109619 or php2shell: "Tientallen gemeentelijke websites nog kwetsbaar na groot PHP-lek". Selected mechanically, not read by a person.

Capture notes

Language nl. The scan results are BNR's, relayed here; the article stresses the findings do not mean all the sites found are actually vulnerable. The page also carries unrelated headlines and a course advertisement. Nothing in the page addresses an AI or hides text from a reader.