21 October 2026

Upate 17.00 hrs (final update)

Update 15.00 hrs

The implementation of the security updates is progressing steadily. The majority of the university’s websites and applications are now functioning properly. The University Library’s digital collections are also back online.

A limited number of websites are still not fully accessible. This mainly concerns websites for which we rely on third-party providers, as well as certain faculty or expertise centre websites. The relevant departments will communicate this information directly to users as needed.   

The next update will follow at approx. 17.00 hrs.

Update 11.00 hrs

For the best connectivity, please use eduroam at the university or eduVPN at home or when on the move today. We are working hard to safely restore access to university websites and applications. To achieve this, we are implementing updates in phases. Most university websites are expected to be accessible to everyone again later today. The majority of  university applications and services are expected to be functioning properly.

What can you expect today?

We expect the disruptions to gradually subside as the day progresses. However, the implementation of updates may cause temporary disruptions. Furthermore, for some applications we must rely on third-party providers. There may also be limited access to certain faculty or institute websites. 

The University Libraries' digital collections are currently unavailable, even via eduVPN. We are working hard to find a solution and hope to make the collections available again later today. 

A new update will be posted here at approx. 15.00 hrs.

Update Wedenesday 21 October 17:00 hrs

PHP has released a security update that addresses the vulnerabilities. Once the update is installed, the websites affected by the issue can be brought back online. This will take some time. After installation, the university websites must first be tested and verified before being put back online.

Reminder: the affected environments will be unavailable from 17.00 hrs today onwards. We expect these environments to be available again via eduroam and eduVPN from 9:00 hrs on Thursday morning. Depending on the impact of the security update, you may need to continue accessing some of these applications via a secure route for a while longer.

Update Wedenesday 21 October 14.00 hrs

The University is working with multiple teams to identify the affected websites and applications, and to assess the impact on education, research and daily operations. At the same time, we are implementing the necessary security measures. The access restrictions announced earlier remain in force.

Where possible, use eduroam on campus or eduVPN at home or while travelling to access the affected websites.

The university’s suppliers have also been affected. As a result, services that we obtain from these suppliers may be operating at a reduced level or may be temporarily unavailable. We are closely monitoring developments involving our suppliers.

Do you have your own website? Our advice: take it offline

Do you use your own website, for example for your research or a conference? We advise you to take it offline. Please also report this to your LISO, so that they are aware of the situation and can provide additional information if necessary.

Affected environments to be shut down between 17.00 and 9.00

The current situation requires continuous monitoring. Therefore, from 17.00 this evening until tomorrow morning, access to the websites that are currently only available via eduroam or eduVPN will be completely suspended.

We expect to make the affected environments available again via eduroam and eduVPN from 9.00 onwards. This may also apply to a number of applications.

We understand that this may disrupt your studies or work. We are working to restore secure access and will update you as soon as more information becomes available.

The next update will be provided at around 17.00.

Original announcement

Due to a vulnerability in the PHP programming language, many websites worldwide are currently vulnerable to attacks. Leiden University is also facing these vulnerabilities and is implementing a number of security measures today as a precaution. Read here what this means for you.

Accessing websites 

The central websites, such as the public website, staff and student websites, and organisation guide do not have this vulnerability and remain fully accessible. However, a number of faculty and institute websites do have this vulnerability.   

For these website, we are therefore taking the following measures:  
The websites in question are temporarily only accessible only via eduroam (the university's Wi-Fi network) and eduVPN. There is also a possibility that certain websites may be temporarily unavailable.   

What this means for you? 

If you want to visit a Leiden University website, please use one of the following secure connections:

• On campus: connect your laptop, phone, or tablet to eduroam  
• At home or on the go: connect to the university network via eduVPN.

Be aware that there may be further developments as the day progresses.

What is the university doing to address the problem?

The university is working hard to secure the vulnerable websites.  As soon as the security update is available and working, we will provide further updates.