🔍 Read the full analysis: What To Know About PHP2Shell And Dutch Government Website Downtime on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released fixes on 21 October 2026 for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution in affected PHP deployments. The Dutch government temporarily took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; its announcement did not report confirmed compromises.
PHP released emergency fixes on 21 October for two critical vulnerabilities that can allow unauthenticated remote code execution, and the Dutch government took several websites offline, including Overheid.nl, MijnOverheid.nl and DigiD, as a precaution. The government’s announcement described preventive action and did not confirm that those services had been compromised.
The flaws, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated Critical. They identify PHP installations handling web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP’s advisories describe failures in memory handling and request state. One flaw involves cleanup after an out-of-memory condition interrupts an operation before request data is fully initialized. The other involves internal state retaining references to request memory after that memory has been freed. The resulting conditions can lead to memory corruption or use-after-free vulnerabilities and, under relevant circumstances, remote code execution.
PHP published fixed releases for its supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project also supplied minimal source backports for PHP 7.4, 8.0 and 8.1. Organizations using distribution packages or extended support should check with their supplier for a fixed package; a version number by itself may not show whether a vendor backport is included.
Security Briefing · 21 October 2026
PHP2Shell & Dutch Government Website Downtime
PHP released fixes for two critical flaws that can enable unauthenticated remote code execution. Several Dutch public-service websites went offline temporarily as a precaution; the announcement did not confirm a compromise.
Where PHP2Shell takes hold
PHP runs beneath website applications. The vulnerabilities affect the PHP engine and request handling, not a particular content management system.
Interrupted cleanup
An out-of-memory condition can interrupt an operation before request data is fully initialized. A failure in cleanup can leave memory in an unsafe state.
Stale request references
Internal state can retain references to request memory after that memory has been freed, creating a use-after-free condition.
Memory corruption
Under relevant conditions, these flaws can lead to memory corruption, sensitive process-memory disclosure, or remote code execution.
Exposure varies
Runtime, server configuration, and application behavior affect attack conditions. PHP reported demonstrated exploitation on Apache with mod_php.
Patch PHP, then verify it is active
Updating WordPress, Drupal, Joomla, themes, or plugins alone does not fix flaws in the PHP engine.
PHP fixed releases
Source backports were also supplied for PHP 7.4, 8.0, and 8.1. For distribution packages or extended support, ask the supplier for a fixed package; a version string may not show whether a vendor backport is included.
Four steps to reduce exposure
Use deployment details and provider confirmation to establish whether the affected PHP runtime has been updated.
Inventory
List websites, PHP branches, hosting providers, and request-serving configurations.
Update
Install the fixed PHP release or a vendor package with the security backport.
Verify
Confirm the patched runtime is active for every relevant service and site.
Keep watch
Follow PHP, NCSC, and vendor advisories; investigate findings separately from attack attempts.
Shutdown, patches, and service return
The government described a preventive action on 21 October. Its statement did not confirm that the named services were compromised.
Services taken offline
Overheid.nl, MijnOverheid.nl, and DigiD were among sites taken offline as a precaution while patches were unavailable.
No signs reported at that time
The announcement reported no signs of active exploitation then. It said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these vulnerabilities.
NCSC urged organizations to update
The Dutch National Cyber Security Centre said patches were available and advised that systems remaining unpatched should stay offline as a precaution.
“The websites were taken offline as a precaution.”
Dutch government announcement“Both vulnerabilities carry a CVSS v4.0 score of 9.2, rated Critical.”
PHP security advisoriesCloudflare reported observing attack traffic and attempts to change payloads to evade protections.
Cloudflare report · attempted exploitationWhat is known—and what remains open
Reports of attempted exploitation and reports about a specific service are different kinds of evidence.
Reported facts
PHP published emergency fixes. The Dutch government said several services were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. Cloudflare reported seeing attack traffic and payload changes.
Not established by the available reporting
Whether any named Dutch service was compromised, whether attackers successfully exploited the flaws elsewhere, or whether sensitive information was exposed. The runtime configuration of each affected Dutch service and a complete count of vulnerable installations are also not provided.
Observed attack attempts do not establish a successful compromise of Overheid.nl, MijnOverheid.nl, or DigiD. The government’s statement reflects the information available at the time; it cannot guarantee what happened later.
Key questions
Practical answers for site owners, hosting customers, and readers following the outage.
What is PHP2Shell?
A collective name for CVE-2026-109618 and CVE-2026-109619, two PHP flaws that can enable unauthenticated remote code execution under relevant conditions.
Were the Dutch sites hacked?
The government said the shutdown was precautionary and reported no signs of active exploitation at the time. Available information does not confirm a compromise of the named services.
Does updating WordPress fix it?
No. The vulnerabilities are in the PHP runtime. Update the server’s PHP software and verify that the fixed runtime is serving the site.
What if a system remains unpatched?
The cited NCSC guidance is to keep it offline as a precaution until it can be updated. Ask a hosting provider or administrator to confirm the active runtime.
Why Runtime Patching Matters
PHP runs on the server beneath website applications, so updating WordPress, Drupal or Joomla code alone does not fix these PHP engine flaws. Operators need to establish which runtime and configuration serve each site, then confirm the patched runtime is actually active. For customers on managed hosting, that means asking the provider whether the PHP service serving their websites has been updated.
Researchers at Wiz demonstrated unauthenticated remote code execution against deployments of WordPress, Drupal and Joomla. Wiz also reported demonstrations of sensitive process-memory disclosure, which could expose credentials or tokens without code execution. Those are examples of the impact of vulnerabilities in the underlying PHP engine, not separate flaws in each content management system.
PHP reported demonstrated exploitation on Apache with mod_php. One advisory says execution occurs as the web worker account, which does not automatically mean administrator or root access. Attack conditions can depend on the server’s runtime and configuration: research cited in the source material describes differences involving PHP-FPM, while also identifying application-dependent paths. That distinction makes checking actual deployment details more useful than assuming every PHP installation has identical exposure.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdown and Patch Timeline
The Dutch government said several services were taken offline on 21 October while patches were not yet available. Its statement reported no signs of active exploitation at that time and framed the shutdown as a precaution. It also said that many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular vulnerabilities.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to evade its protections. That report concerns attempted exploitation; it does not establish that the named Dutch government services were breached.
The disclosure also involved security research using AI tools. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz reported independently discovering and disclosing both vulnerabilities. PHP maintainers led the fixes and releases. Calif’s account says its initial discovery used generally available models and that the researcher guided the work using knowledge of PHP’s vulnerability history. These descriptions are attributed accounts of the research process, not evidence that AI acted without human direction.
“The websites were taken offline as a precaution.”
— Dutch government announcement
What Is Known About Exploitation
The government’s reported lack of signs of active exploitation applied at the time of its announcement; it is not a guarantee about later activity. The source material does not establish whether any of the Dutch services were compromised, whether attackers successfully exploited the flaws elsewhere, or whether any sensitive information was exposed. Cloudflare’s report of attack attempts does not answer those questions.
Exposure also varies by PHP version, server configuration and application behavior. The available reporting does not identify the runtime configuration for each affected Dutch service or give a complete count of vulnerable installations. Operators should rely on their hosting provider or system administrator for confirmation that the relevant PHP runtime has been patched and is serving traffic.
Patch Verification and Service Returns
Organizations running PHP should apply the fixed release for their branch, or obtain a vendor-provided patched package, and verify that the patched runtime is active for each relevant service. If a system remains unpatched, the Dutch NCSC guidance cited here is to keep it offline as a precaution. Updating the application or its plugins alone is not a substitute for updating PHP.
The Dutch government’s next operational step is to restore affected services when its security response permits. The source material does not provide a timetable for that restoration. Website operators and hosting providers should watch for further advisories from PHP, the NCSC and their software vendors, and assess any investigation findings separately from reports of attempted attacks.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under relevant conditions, they can lead to unauthenticated remote code execution.
Were the Dutch government websites hacked?
The government said it took several services offline as a precaution and reported no signs of active exploitation at the time of its announcement. The available information does not confirm a compromise of Overheid.nl, MijnOverheid.nl or DigiD.
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP runtime, so updating WordPress, its themes or plugins alone does not patch them. The server’s PHP software must be updated, and operators should verify that the fixed runtime is serving the site.
Which PHP releases include the fixes?
The fixed releases listed by PHP are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied source backports for 7.4, 8.0 and 8.1. Users of vendor-supported packages should check directly with their supplier because backports may not be evident from the version number alone.
What should a website operator do now?
Identify the PHP runtime and configuration serving each website, install the appropriate fixed release or vendor package, and confirm the patched runtime is active. If the service is hosted by a third party, ask the provider for confirmation. Systems that remain unpatched should follow the applicable security guidance; the Dutch NCSC advises keeping them offline as a precaution.
Source: ThorstenMeyerAI.com
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
