DigiD Went Dark on Purpose. Logius took DigiD, MijnOverheid, and Overheid.nl offline on 21 October. It was a precaution, not a confirmed intrusion.

The Dutch government did not wait to see if PHP2Shell was theoretical. It turned off the sites people use to prove who they are.

On Wednesday 21 October, Rijksoverheid said a number of government sites were taken offline as a precaution after two critical flaws in PHP. The list it named included Overheid.nl, MijnOverheid.nl, and DigiD. The NCSC had not, at that point, seen signs the flaws were being exploited. The sites still went down. Logius, which runs MijnOverheid, confirmed the shutdown. NRC also reported the Tweede Kamer site offline the same day.

Read that again. The identity portal went dark before the patch, not after a breach notice.

What stayed up, and what did not

Reporting through the day was messy, which is normal when the website and the login protocol are different things. The DigiD website was unreachable. Some reports said you could still sign in with DigiD on other sites that were still online. The app was partly down. By Wednesday evening, MijnOverheid and then DigiD.nl were reported back. Overheid.nl was still cited as down in at least one late update.

Do not publish this piece with "DigiD is down" in the present tense. Stamp it. As of Wednesday evening, 21 October, the precautionary outage had started in the morning and the identity sites were coming back after PHP's fixes landed around 16:00 Dutch time.

The sentence the NCSC used

This was not sold as an attack. A Rijksoverheid update said the patches were available and that site owners should apply them as fast as possible. The earlier advice was to weigh the risk and, if needed, take the site offline until the update existed. PHP had told users to prepare for a release at 14:00 UTC. Dutch time, that was 16:00.

That is the operational lesson. A CVSS 9.2 in the language under the site is not a ticket you schedule for Friday if the site is DigiD. You eat the outage, you install 8.5.12, 8.4.27, 8.3.36, or 8.2.35, you restart the workers, and you bring the hostname back only after the new binary is the one serving.

Hospitals, municipalities, RTL, and council-information platforms were in the same Dutch wave. They get their own mentions later if this series keeps going. This post is about the org that had to explain to the whole country why the login page was a maintenance screen.

Sources: Rijksoverheid, 21 October 2026; NRC; PHP advisory.