Dutch legal gambling sites stay online during PHP vulnerability as Cruks sign-ups stall

A serious vulnerability in the PHP programming language, which led several Dutch organisations to take websites offline as a precaution, had not caused confirmed outages at legal online gambling providers as of 21 October. The outlet said it checked the websites of 30 licensed online gambling providers and that all were reachable at the time of writing, and that logging in at all legal gambling sites worked without problems. CasinoNieuws.nl said it examined public technical characteristics of the gambling sites but could not establish which providers use the affected PHP software.

The Kansspelautoriteit (KSA) took its own websites, kansspelautoriteit.nl and openovergokken.nl, offline shortly before 14:00 on 21 October, according to a statement it posted on LinkedIn. The regulator said the move followed a serious security vulnerability in PHP that makes websites worldwide vulnerable to hackers, and that other organisations including DigiD, MijnOverheid and the Tweede Kamer had taken their sites offline for the same reason. The KSA said cruksregister.nl remained reachable and that gambling providers could continue to carry out Cruks checks, but that people could not register in Cruks (Centraal Register Uitsluiting Kansspelen) because DigiD was offline. The KSA said the Nationaal Cyber Security Centrum (NCSC-NL) had so far not established active exploitation of the vulnerability, and that it would bring its websites back online only once the necessary updates had been carried out and the systems were safe.

After 18:00 the KSA reported that its own site was back online but that Cruks still did not work, because DigiD remained offline. The regulator said registration in Cruks would be possible again once DigiD worked.

Among operators, Tamas Mezosi, CEO at the parent company of Oranje Palace, said Oranje Palace does not use PHP and is therefore not affected, and that its website remains available with all services operational. Unibet spokesperson Ryan van Osch said the operator had checked internally and that Unibet.nl does not run on PHP, placing it outside the scope of the problem. TOTO and sister brand Winnitt remained online, but Nederlandse Loterij, the parent company, said the TOTO Winkel website had been taken offline temporarily because of the PHP vulnerabilities and that it was working to restore the site as quickly as possible. Holland Casino told CasinoNieuws.nl it was analysing the situation and carrying out checks on its websites, and that the online casino was in any case safe, according to Ilan Sluijs.

DigiD.nl was taken offline, but DigiD continued to work through the app, for example to log in at cruksregister.nl. The outlet reported that DigiD, MijnOverheid and the Tweede Kamer website were among the sites taken offline on Wednesday because of the security problems, citing NOS, and that a security update had been scheduled for 21 October at 16:00 Dutch time. CasinoNieuws.nl and the OneTime forum were also taken offline as a precaution and both returned online before 17:00, the outlet said. The article was published on 21 October 2026 and last edited on 22 October 2026.