Security
Is my website secure?
On 21 October 2026 a large part of the Dutch internet went offline as a precaution. What that means for your website, and how to know whether you are in good shape.
A website is secure when both the server and the software of the website itself are up to date, backups exist and work, and someone keeps track of advisories about new vulnerabilities. Most websites meet the first condition and none of the others.
What happened on 21 October 2026
Two serious vulnerabilities were discovered in PHP, the programming language behind more than three quarters of all websites. Through those flaws an attacker could run their own code on a server without logging in. The flaws received a severity score of 9.2 out of 10, and the details leaked before the fix was available.
The effect was visible across the Netherlands. The websites of the Dutch House of Representatives, MijnOverheid, DigiD and the national railways went offline as a precaution, as did those of many media companies and hosting providers. At the end of the afternoon PHP released an update that closed the vulnerabilities.
What Darvis did that day
We follow the advisories of the PHP security team. Once it became clear how serious these vulnerabilities were, we closed all servers before the details became public and informed our clients. As soon as the update was available, it was installed and verified on every server. The same day all websites were back online, with an additional security layer that stops attacks before they reach the website.
That is not an exception but the normal course of events for a secure website. The difference lies in who reads the advisories and who is able to act.
The server is only half the story
A server update, like the one of 21 October, solves the problem in the layer underneath your website. The software of the website itself is not covered: the CMS, the theme, the plugins and the integrations with other systems. Those have their own vulnerabilities and their own updates, and those updates only happen when someone is responsible for them.
In practice that is the layer where things go wrong. A website delivered three years ago and not updated since runs today on a secure server, with software on top of it carrying vulnerabilities that have been known for years. Why that happens faster on standard platforms with many plugins than with custom code is explained on the page why not WordPress.
Three questions every business owner may ask themselves
- Do you know which software your website uses and when it was last updated? Most business owners do not know exactly, and that is understandable: it is not their field.
- What does it cost if your website is down for a day? Not only in revenue, but in enquiries that never arrive, customers who call, and the time it takes to put everything right again.
- Who do you call at that moment? If you have to think about that, that is an answer in itself.
Why this needs more attention now than a few years ago
The vulnerabilities of 21 October were found with the help of artificial intelligence, and within hours of the leak working attacks were circulating. That pace is only increasing. A website that has not been updated for a few years used to be a risk. Today it is a matter of time.
What a website scan delivers
In a website scan we look at the layer the hosting provider does not see:
- Software and versions: which CMS and which plugins the website uses and how far behind the current version they are.
- Known vulnerabilities: whether those versions contain flaws an attacker can exploit.
- Backups: whether they exist, how old they are and whether they can actually be restored.
- Access: how the admin area is protected and who can get in.
- Forms and integrations: whether the parts that process visitor data do so securely.
You receive a short report in plain language: what is in order, what needs attention and what that means for you. You can act on it yourself, or have us fix the findings. If you would rather not keep an eye on this at all, the pages on website maintenance and the maintenance contract explain how we take it off your hands entirely.
While you are at it: can AI find your website?
If you are having your website updated anyway, the door is already open. That is a good moment to look at something else as well: more and more people ask their question not to Google but to ChatGPT, Copilot or Gemini. Those assistants read websites differently from a search engine. Most websites are set up for Google and not for AI, and therefore stay invisible in the answer such an assistant gives.
In the website scan we therefore also look at how your website appears to an AI assistant, and what it would take to be included in its answers.
Frequently asked questions
Was my website hacked during the PHP vulnerability of 21 October 2026?
For the websites hosted by Darvis there is no indication of that. The servers were closed before the details of the vulnerability became public and reopened only after the update had been installed and verified. If your website is hosted elsewhere, ask your hosting provider when the update was applied and whether the website was reachable in the meantime.
My website is with another hosting provider. Does this apply to me?
Yes. The vulnerability was in PHP itself, the technology underneath most websites, so it affected virtually every hosting provider. Whether your website is secure now depends on two things: has the provider updated the server, and is the software of the website itself up to date. The first you can ask; the second is what we check in a website scan.
What is the difference between the server and the software of my website?
The server is the computer your website runs on, with the operating system, the web server and PHP. It is maintained by the hosting provider. The software of your website is what sits on top of it: the CMS, the theme, the plugins and the integrations. Those are not covered by server maintenance and are, in practice, the most common entry point for a hack.
How often should the software of a website be updated?
At least once a year and preferably twice, and immediately whenever a serious vulnerability becomes known in a component your website uses. If you would rather not keep track of that yourself, a maintenance contract covers it: Darvis then monitors the advisories and applies the updates.
What does a website scan cost?
The website scan is free and comes without obligation. You receive a short report in plain language with what is in order and what needs attention. If you then want us to fix the findings or take over the maintenance, you receive a price for that in advance.