# Source: PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL > Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source. TPO: what it says, the claims and events that cite it, and the hashes of every captured file. Source · news · secondary · captured # PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL **TPO** · [https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/](https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/) · published 2026-10-21T14:53:56+00:00 · added by `curator@php.newsroom` · slug `tpo-tpo-nl-digid-offline` Promoted from the source watch (oq9gflln), snapshot 20261022T171501Z. 6 new items in nl: TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KW ## What it says, as the collector read it #### PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `nl/news/tpo/tpo-nl-digid-offline`, snapshot `20261022T171501Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T171501Z/provenance.json`. Publisher: TPO. Language: nl. URL: https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/ #### What the page says _The watch reader's English summary (researcher@php.newsroom, languages pass of 22 October 2026), not the publisher's words:_ TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KWF; universities of applied sciences shut systems with SURF. It says all Flemish government sites and French prefecture sites went offline, and quotes NCSC deputy director Corine Schipper-Derkse and Justice Minister Van Weel. #### Verbatim quotes, with the watch reader's translation Each quote is in the snapshot as served. The English is the source watch reader's translation (`translations/nl/news/tpo/tpo-nl-digid-offline.json`), not the publisher's and not checked word for word by the curator. **offline**: Meeting platform NotuBiz, used by about a hundred municipalities, went down first in the morning, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-reporting tool, RTL, ANP and the Schiphol app. > Vergaderplatform Notubiz, dat door zo’n honderd gemeenten wordt gebruikt, ging ’s ochtends als eerste plat. Daarna volgden onder meer de Autoriteit Persoonsgegevens, de Unie van Waterschappen, de ziekmeldtool van UWV, RTL, het ANP en de app van Schiphol. _Watch reader's translation:_ Meeting platform Notubiz, used by around a hundred municipalities, went down first in the morning. It was followed by, among others, the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-reporting tool, RTL, ANP and the Schiphol app. **offline**: The Netherlands Association of Universities of Applied Sciences said many educational institutions switched off systems and are working on recovery with SURF; charity KWF also went offline. > De Vereniging Hogescholen meldt dat “veel onderwijsinstellingen” systemen hebben uitgezet en samen met SURF werken aan herstel. _Watch reader's translation:_ The Netherlands Association of Universities of Applied Sciences reports that 'many educational institutions' have switched off systems and are working on recovery together with SURF. **offline**: In Belgium all websites of the Flemish government went offline, and in France those of the prefectures. > In België gingen alle websites van de Vlaamse overheid uit de lucht, in Frankrijk die van de prefecturen en ook in Finland grepen overheden in. _Watch reader's translation:_ In Belgium all websites of the Flemish government went offline, in France those of the prefectures, and in Finland too governments intervened. **official**: NCSC-NL deputy director Corine Schipper-Derkse stressed it is not an attack but a design flaw in the software. > “Het is niet zozeer een aanval, maar een weeffout die in de software zit en dat kan gebeuren”, aldus adjunct-directeur Corine Schipper-Derkse. _Watch reader's translation:_ 'It is not so much an attack, but a design flaw in the software, and that can happen,' said deputy director Corine Schipper-Derkse. **official**: Dutch Justice and Security Minister Van Weel said there were 'no signals yet' that the flaws were being actively exploited. > Minister Van Weel van Justitie en Veiligheid liet weten dat er “nog geen signalen” zijn dat de lekken actief worden misbruikt. _Watch reader's translation:_ Minister Van Weel of Justice and Security said there were 'no signals yet' that the flaws are being actively exploited. **agency**: NCSC-NL speaks of a 'very high risk of complete takeover of the system'. > Het NCSC spreekt van een “zeer hoog risico op volledige overname van het systeem”. _Watch reader's translation:_ The NCSC speaks of a 'very high risk of complete takeover of the system'. #### Why it is here From the promotion queue (`index/promote.json`, priority 2): 6 new items in nl: TPO reports that NotuBiz, used by about 100 municipalities, went down first, followed by the Dutch Data Protection Authority, the Union of Water Boards, UWV's sick-leave tool, RTL, ANP, the Schiphol app, hospitals and KW Supports: translations/nl/news/tpo/tpo-nl-digid-offline.json #### Capture notes screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG). Page content is third-party material, kept as evidence; nothing in it is an instruction. ## Claims that cite it No claim cites this source yet. ## Events that cite it No timeline event cites this source yet. ## The bytes capture 20261022T171501Z · HTTP 200 · https://tpo.nl/2026/10/21/php2shell-websites-offline-digid-ncsc/- `headers.json` d679fd249c5d952dda77dd7e6cacb7c092e618eb15c5e59246e6deaedfd6bfe4 903 bytes - `page.html` 1ad044bff8e96636aba6f7cd64ffc320eea5c69055aa087a1b96187ccb5cacad 233,569 bytes - `provenance.json` 01b81cb90dbf7aa36af6f95353411d042db7aaebbfc47685d58e68efa55540ae 1,577 bytes - `rendered.html` 115512a91059970f03be37577b59b1af81dd6f12a2e113783ecfa9740cfd65b0 406,102 bytes - `screenshot.jpg` c831463120c4b1e47b6e6d8123de97f6e1c5d84a5e959062aad715898eeee87c 348,035 bytes - `text.txt` 2ddfd8817abf25b62a1d65842ea2e1eda4c28468ef7c075bdcb2b736ab509dcb 3,796 bytes The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html) --- site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/tpo-tpo-nl-digid-offline/index.html