ARCUHN

ARC Lab

No. 05 ·

Lees in het Nederlands: ENNL

Who pulls the plug

ARC Analysis · Anomaly, Reframe, Create

In short

AAnomaly

On 21 October 2026, DigiD, MijnOverheid and the Dutch parliament switched off their own websites. Not hacked. Switched off, after a critical leak in PHP was made public 3. AI helped find it. It had been in PHP for over a decade 1.

RReframe

AI found the hole. It did not decide what to do with it. A person pressed "off", without the full picture. And most of us don't know what we run on. My own website used PHP. It doesn't any more.

CCreate: questions for your team

  1. Who here is allowed to pull the plug?
  2. Who knows what it would touch?

Rethink the premise.

Go deeper The full piece, with all sources

AAnomaly

On 21 October 2026, DigiD, MijnOverheid and the Dutch parliament switched off their own websites. Not hacked. Switched off, as a precaution, after a critical leak in PHP was made public 3.

The leak was found by Wiz Research, a security team working with AI. According to Wiz, the flaw had been in PHP for more than a decade, and "a single researcher completed in a week what previously would have taken a world-class team months." 1 They reported it to PHP in August; the fix came on 21 October 1. Attacks were reported in the days after. Whether any succeeded is still unclear 3.

My own website used PHP. I didn't know what I depended on 4. It doesn't any more.

RReframe

That week was about the code, and about the AI. The moment that stays with me is the person who pressed "off". AI found the hole. It did not decide what to do with it. Someone did, without the full picture. And the leak showed something less visible: how many organisations, mine included, run on software they never think about. That is the anomaly, not the leak.

CCreate: questions for your team

  1. Who here is allowed to pull the plug?
  2. How much would this touch our data?
  3. Who knows the answer?

Rethink the premise.

Sources

  1. PHP2Shell: AI uncovers critical RCE vulnerabilitiesWiz Research · 2026 · Primary disclosure · https://www.wiz.io/blog/php2shell-php-rceStrong
  2. De rol van AI in PHP-lekkenVRT NWS · 2026 · News · https://www.vrt.be/vrtnws/nl/2026/10/21/de-rol-van-ai-in-php-lekken-terzake/Strong
  3. Misbruik van PHP2Shell-lek gemeld, DigiD en andere sites weer onlineSecurity.NL · 2026 · News · https://www.security.nl/posting/958424/Strong
  4. Own observation: ARCUHN website filesARCUHN · 2026 · Own checkMedium · own observation, not a study