🔍 Read the full analysis: PHP2Shell Exposes Critical PHP Flaws As Dutch Government Websites Go Offline on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency updates on 21 October 2026 for two critical vulnerabilities that can allow unauthenticated remote code execution. Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; the government said it had no signs those services were actively exploited at the time of its announcement.
PHP released emergency updates on 21 October 2026 for two critical flaws that can let attackers run code remotely without logging in, while the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. The government said there were no signs of active exploitation of those services when it announced the shutdown; taking them offline was a preventive measure, not confirmation they had been breached.
The vulnerabilities, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated Critical. The flaws affect PHP installations that process web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP describes one flaw as involving an out-of-memory failure that interrupts request processing before internal data is fully initialized. Cleanup may then handle that invalid data incorrectly, causing memory corruption. The other involves internal state retaining references to request memory after that memory has been freed, creating a use-after-free condition. Both conditions can lead to remote code execution. PHP’s advisory says demonstrated exploitation of the out-of-memory flaw runs code as the web worker account, which does not by itself mean an attacker gains administrator or root privileges.
The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1. Organizations using distribution packages or extended-support versions need to check with their software vendor for a fixed package; an older version number alone does not show whether a backport has been applied.
Cybersecurity briefing · 21 October 2026
PHP2Shell Exposes Critical PHP Flaws As Dutch Government Websites Go Offline
Two critical PHP vulnerabilities can enable unauthenticated remote code execution. Dutch authorities took several public services offline as a precaution while fixes became available. The shutdown was not confirmation of a breach.
Two memory failures, one serious risk
The issues affect PHP request processing across multiple deployment types. They sit in the runtime beneath websites and applications.
Out-of-memory failure
An interrupted request can leave internal data only partly initialized. Incorrect cleanup may then corrupt memory and allow code execution.
Use-after-free
Internal state may retain references to request memory after it has been freed. That invalid reference can create a path to remote code execution.
Request handling runtimes
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are among the ways PHP may process web requests.
Patch the PHP runtime serving requests
Updating WordPress, Drupal, Joomla or their plugins does not patch the PHP software underneath them.
Fixed upstream releases
Minimal source backports were also supplied for PHP 7.4, 8.0 and 8.1. For distribution packages or extended-support releases, check the software vendor for a fixed package; a version label alone may not reveal whether a backport is present.
From exposure check to service restoration
For systems that cannot yet be updated, Dutch NCSC guidance says they should remain offline as a precaution.
Find which runtime and version serves each web service.
Use the upstream release or a confirmed vendor backport.
Check that patched software is actually handling requests.
For managed hosting, get confirmation from the provider.
Keep the shutdown and attack reports in context
Observed attack attempts show activity around the flaws, but do not establish compromise of the named Dutch services.
Reported by authorities
- Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution.
- The government reported no signs of active exploitation at the time of its statement.
- It said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these flaws.
Research and provider reporting
- Cloudflare reported attack traffic and attempts to alter payloads to bypass protections.
- Wiz demonstrated code execution across WordPress, Drupal and Joomla deployments, plus sensitive process memory disclosure.
- Calif described application-dependent exploitation paths involving PHP-FPM. Demonstrations do not establish that every named service was exploited.
What to verify next
The available source material does not give a restoration timetable or a final conclusion about compromise.
Were the Dutch sites hacked?
The government reported no signs of active exploitation when it announced the precautionary shutdown. The shutdown does not confirm a breach; the cited reports do not establish compromise of those services.
Will a CMS update fix PHP2Shell?
No. The flaws affect the PHP runtime. Operators need to verify that the PHP package serving requests has a fix, including when using managed hosting.
Which versions are fixed?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 include fixes. Check vendors for backported or extended-support packages.
What should operators do now?
Identify each runtime, apply the relevant upstream or vendor fix, and verify it is active. Keep systems offline if they cannot yet be updated, following Dutch NCSC guidance.
Runtime Patching Is the Key Defense
The flaws affect the PHP runtime beneath websites, rather than a particular content-management system. Updating WordPress, Drupal or Joomla code and plugins does not, on its own, fix vulnerable PHP software. Operators need to establish which runtime serves each site and confirm that the patched version or a vendor-provided backport is active.
That distinction matters for organizations using managed hosting, where customers may not control the underlying runtime. They need confirmation from their provider that the PHP service serving their sites has been patched. PHP says the flaws can affect several ways of handling web requests, so checking only an application’s own update status may leave the central exposure unresolved.
The shutdowns also show how a serious software flaw can affect access to public services even when a breach has not been confirmed. The Dutch government’s decision was a precaution while the risk was being addressed. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations point to attempted exploitation generally; they do not establish that the Dutch services were compromised.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and Available Fixes
The Dutch government said on 21 October that several government websites, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline as a precaution. It said there were no signs of active exploitation at the time of that statement. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. PHP’s advisories and the NCSC guidance make the immediate response dependent on whether the specific server has received a fix, rather than on the website’s public-facing application alone.
Researchers reported demonstrations against multiple deployment types. Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments, as well as disclosure of sensitive process memory that could expose credentials or tokens without code execution. Calif described application-dependent exploitation paths involving PHP-FPM. These are research demonstrations and technical findings; they do not establish that every installation or named service was exploited.
“The demonstrated execution runs as the web worker account.”
— PHP security advisory
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Service Exposure Still Needs Checking
The Dutch government’s initial statement reported no signs of active exploitation of the affected services at that time, but the available material does not establish their final security status after investigation or patching. Nor does Cloudflare’s report of attack attempts identify the Dutch government websites as targets or confirm a successful compromise.
It is not yet clear from the cited material when each service will return online, which exact software configurations were present on the affected systems, or whether every hosting provider has completed patching. Exposure can differ by PHP runtime, configuration and application behavior. Organizations should rely on their provider’s fixed-package information and the relevant PHP or operating-system vendor advisories rather than infer safety from an application update or a version label alone.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations running PHP should identify the runtime and version handling each web service, apply the appropriate upstream or vendor-provided fix, and verify that the patched software is actually serving requests. For systems that cannot yet be updated, Dutch NCSC guidance is to keep them offline as a precaution.
The next public milestones are confirmation that affected services have been patched and restored, along with any further findings from government or security-provider investigations. PHP administrators should also follow vendor advisories for supported branches and backported packages. The source material does not give a timetable for restoring the Dutch sites or report a final conclusion about compromise.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated Critical and can lead to remote code execution without a login.
Were the Dutch government websites hacked?
The government said it took several websites offline as a precaution and reported no signs of active exploitation at the time of its announcement. The shutdown does not confirm a breach. Cloudflare’s separate report of attack attempts does not establish that the named Dutch services were compromised.
Which PHP versions include the fixes?
The source lists fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It also says minimal source backports were provided for PHP 7.4, 8.0 and 8.1. Users of vendor or extended-support packages should check whether their provider has issued a fixed package.
Will updating WordPress or a plugin fix the flaws?
No. These issues affect the PHP runtime, which is separate from WordPress and its plugins. Site owners need to verify that the PHP version or vendor package serving the site has been patched.
What should a PHP website operator do now?
Identify the PHP runtime serving each web service, apply the relevant upstream or vendor fix, and verify the patched runtime is active. If the system cannot be updated, Dutch NCSC guidance says it should remain offline as a precaution.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
