Websites Erasmus University temporarily accessible only from campus during PHP crisis

Several online services at Erasmus University have restricted access until Thursday morning as a precaution because of problems with the PHP programming language. The university website, for example, was only accessible from campus. EM’s website stayed online, but publishing was temporarily not possible.

When it became clear on Wednesday morning that PHP had two serious vulnerabilities, increasing numbers of websites around the world went offline as a precaution. A fix was due to be released at 4 pm. Until then, websites using PHP were at serious risk of being hacked.

Around midday, the university website and the MyEUR intranet were therefore disconnected from the internet and made accessible only on campus. Services such as OSIRIS and Canvas remained online. According to a spokesperson, Wednesday was the first time a new crisis page had been deployed: status.eur.nl. Students and staff could use the page to keep up to date with developments. The websites were available again on Thursday morning.

Erasmus Magazine’s website stayed online throughout Wednesday, but technical restrictions meant the editorial team could not publish any new articles until Wednesday evening. They were eventually published on Thursday.

Education and research

Many other universities took their websites completely offline on Wednesday, including those in Delft, Tilburg, Eindhoven and Nijmegen. Research organisations NWO and KNAW also took their websites offline, as did various higher education media outlets. Rotterdam university of applied sciences’ magazine Profielen went offline as a precaution, as did Bron (Fontys) and university magazines including Vox (Nijmegen), Ad Valvas (VU Amsterdam), Mare (Leiden) and UKrant (Groningen). 

Education IT organisation SURF shut down ‘certain services’ as a precaution, its spokesperson said. SURF’s network remained intact. Many educational institutions connect to the internet through SURF. The SURFconext login application was also offline while it awaited the PHP update.

Vigilance needed

The PHP vulnerability is so serious that security experts expect it to be exploited for years to come. Many people and businesses do not install updates straight away. This means that all kinds of devices people connect to the internet at home are also likely to remain vulnerable for a long time.

According to technology website Tweakers (which also went offline as a precaution), PHP is used on almost 70 per cent of websites worldwide. The PHP security team gave the vulnerabilities a score of 9.2 out of 10 to indicate how dangerous the flaw is.