21 October 2026

Update 14.00 hrs

The University is working with multiple teams to identify the affected websites and applications, and to assess the impact on education, research and daily operations. At the same time, we are implementing the necessary security measures. The access restrictions announced earlier remain in force.

Where possible, use eduroam on campus or eduVPN at home or while travelling to access the affected websites.

The university’s suppliers have also been affected. As a result, services that we obtain from these suppliers may be operating at a reduced level or may be temporarily unavailable. We are closely monitoring developments involving our suppliers.

Do you have your own website? Our advice: take it offline

Do you use your own website, for example for your research or a conference? We advise you to take it offline. Please also report this to your LISO, so that they are aware of the situation and can provide additional information if necessary.

Affected environments to be shut down between 17.00 and 9.00

The current situation requires continuous monitoring. Therefore, from 17.00 this evening until tomorrow morning, access to the websites that are currently only available via eduroam or eduVPN will be completely suspended.

We expect to make the affected environments available again via eduroam and eduVPN from 9.00 onwards. This may also apply to a number of applications.

We understand that this may disrupt your studies or work. We are working to restore secure access and will update you as soon as more information becomes available.

The next update will be provided at around 17.0o.

Original announcement

Due to a vulnerability in the PHP programming language, many websites worldwide are currently vulnerable to attacks. Leiden University is also facing these vulnerabilities and is implementing a number of security measures today as a precaution. Read here what this means for you.

Accessing websites 

The central websites, such as the public website, staff and student websites, and organisation guide do not have this vulnerability and remain fully accessible. However, a number of faculty and institute websites do have this vulnerability.   

For these website, we are therefore taking the following measures:  
The websites in question are temporarily only accessible only via eduroam (the university's Wi-Fi network) and eduVPN. There is also a possibility that certain websites may be temporarily unavailable.   

What this means for you? 

If you want to visit a Leiden University website, please use one of the following secure connections:

• On campus: connect your laptop, phone, or tablet to eduroam  
• At home or on the go: connect to the university network via eduVPN.

Be aware that there may be further developments as the day progresses.

What is the university doing to address the problem?

The university is working hard to secure the vulnerable websites.  As soon as the security update is available and working, we will provide further updates.