Two serious vulnerabilities in IT systems: what is going on and what you can do

Last night, two serious vulnerabilities came to light that affect many IT systems worldwide. The first is in the WebPKI: the system of certificates that lets systems check whether a website or online service really is who it claims to be. At certificate provider eMudhra, the keys of eight so-called intermediate certificates were generated incorrectly, which means malicious parties can work them out. With such a key, an attacker can impersonate almost any website or service. Major browsers such as Chrome, Firefox, Safari and Edge now block these certificates, but many other systems, such as servers, links between applications and software, still need to be updated. The incident has no consequences for eIDAS certificates or PKIoverheid.

The second vulnerability is in PHP, a programming language that many web applications run on. It concerns two critical flaws that allow an attacker to run malicious code remotely and without logging in. Almost all PHP versions may be vulnerable. A security update is expected today at around 16:00 Dutch time. As a precaution, many organisations have temporarily taken their websites and online services offline, including the Dutch House of Representatives, the Dutch Data Protection Authority and the NCSC.

A vulnerable digital world

Incidents like these do not stand alone. Our digital world is complex and closely interconnected: one mistake at one party can affect organisations around the world within a few hours. At the same time, attackers are getting ever faster at exploiting such vulnerabilities. That calls for vigilance, quick action and good cooperation between all parties in the chain.

What Cleverbase has done

As soon as the news broke, Cleverbase took immediate action. We have updated our IT systems so that the affected eMudhra certificates are no longer trusted. As a result, our services for identification, logging in and signing are not at increased risk.

For the PHP vulnerability, we have also checked our own systems. One system, with limited impact on our services, runs on PHP. As a precaution, we have switched that system off until the security update has been installed. In addition, we are investigating the impact on our suppliers' systems, and taking measures where needed.

What does this mean for your organisation?

We advise everyone to check their own IT systems as well. Update browsers and operating systems to the latest version, and have your IT administrator or supplier check whether servers and software already use an updated list of trusted certificates.

Does your organisation use applications that run on PHP? Then install the update as soon as it is available. If you cannot update straight away, strongly consider taking these applications off the internet temporarily until you can. The National Cyber Security Centre (NCSC) urgently calls on organisations to prepare for the emergency update for PHP, so that it can be installed as soon as it is available. According to the NCSC, no active exploitation of the vulnerabilities has been observed yet. As a precaution, the NCSC has temporarily taken its own website offline. For more information: https://cert.europa.eu/publications/security-advisories/2026-018/

Staying safe online together

We like to keep everyone safe online, and we do that together. Do you, as a user or customer, have further questions about securing identification, logging in or signing within your organisation? Then contact us via https://cleverbase.com/en/contact/.

We are monitoring the situation closely. As soon as there are new developments, we will share them on this page.

Last updated: Wednesday 21 October 2026, 14:15