Resolved -
This incident has been resolved.
Oct 21, 16:54 CEST
Update -
We are continuing to monitor for any further issues.
Oct 21, 12:49 CEST
Monitoring -
Nederlands
Zoals je op veel plekken online kunt lezen, is er een groot beveiligingslek in PHP ontdekt. Er zijn op dit moment geen aanwijzingen dat deze kwetsbaarheid bij Dyflexis is misbruikt. Om 16:00 uur (CET) komt er een patch. Voor de zekerheid is Dyflexis tot die tijd niet beschikbaar. Zodra de patch is doorgevoerd, zijn we direct weer online. Excuses voor het ongemak.
Update: de patch is doorgevoerd. We zijn weer online en Dyflexis is weer beschikbaar.
Deutsch
Wie vielerorts im Internet zu lesen ist, gibt es eine schwerwiegende Sicherheitslücke in PHP. Derzeit gibt es keine Hinweise darauf, dass diese Schwachstelle bei Dyflexis ausgenutzt wurde. Um 16:00 Uhr (MEZ) wird ein Patch veröffentlicht. Sicher ist sicher: Dyflexis bleibt bis dahin offline. Sobald der Patch eingespielt ist, sind wir sofort wieder online. Wir entschuldigen uns für die Unannehmlichkeiten.
Update: Der Patch wurde eingespielt. Wir sind wieder online und Dyflexis ist wieder verfügbar.
English
As you may have read online, a major security vulnerability has been found in PHP. There is currently no indication that this vulnerability has been exploited at Dyflexis. A patch will be released at 16:00 (CET). To be safe, Dyflexis will be offline until then. As soon as the patch has been applied, we’ll be back online right away. We apologise for the inconvenience.
Update: The patch has been applied. We are online—Dyflexis is available again.
UPDATE 22.10.2026
Review of the incident:
Dear customer,
On Wednesday 21 October, Dyflexis was unavailable from 12:45 to 16:45 CEST. We made this choice deliberately to protect your data against a vulnerability in PHP, the programming language our web servers run on. There has been no unauthorised access to your
data.
Below you can read what happened, the trade-offs we made and what we are doing now.
Timeline
03:00: We are notified of a critical vulnerability in PHP. The details are not yet public. The Dutch National Cyber Security Centre (NCSC) advises monitoring and not yet taking action.
From 03:00: We immediately put extra monitoring on all traffic to Dyflexis. We also continuously follow the sources that report whether hacks or exploits are circulating. Based on this, we keep assessing whether we can guarantee the security of your data.
12:45: Several sources report that attackers are actively exploiting the vulnerability elsewhere on the internet. We see no signs of this on our own systems. Even so, we can no longer fully guarantee the security of your data. We immediately block all access to Dyflexis as a precaution and activate our emergency communication protocol.
Around 15:45: PHP releases the patch. We download it and test it on a separate test environment, following our standard procedure.
16:15: The test is successful. We roll out the patch to all production systems.
16:45: All systems are fully available again.
Why we took Dyflexis offline
A four-hour outage affects your planning and your people. We are well aware of that. Even so, the security and confidentiality of your data matter more to us than availability. Once we could no longer be fully certain, taking the platform offline was the only
responsible choice.
Where we stand now
The incident is now in the follow-up phase. In practice, this means:
-increased monitoring of data traffic;
-additional checks on log files;
-a full analysis of all available data.
This analysis shows that there has been no unauthorised access to the data in the Dyflexis environment. You do not need to take any action.
Oct 21, 10:16 CEST
