🔍 Read the full analysis: A Breakdown Of PHP2Shell, PHP Flaws, And Dutch Government Site Outages on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released security updates on Oct. 21 for two critical vulnerabilities that can enable unauthenticated remote code execution in affected PHP deployments. Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; their announcement did not report confirmed compromises.
PHP released emergency fixes on Oct. 21 for two critical flaws, dubbed PHP2Shell, that can allow unauthenticated remote code execution in affected web-server deployments. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not say those services had been compromised.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated Critical. The flaws involve PHP’s handling of memory and internal state when request processing is interrupted: one can leave data incompletely initialized after an out-of-memory failure, while the other can leave references to memory that has been freed. Under certain conditions, those errors can lead to code execution.
PHP lists web-facing installations as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project published fixes for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1; organizations using distribution or extended-support packages need to check for their vendor’s fixed release. An older version string alone does not show whether a backport is installed.
PHP’s advisories describe demonstrated exploitation on Apache with mod_php. The out-of-memory advisory says execution occurs as the web worker account, which does not by itself imply administrator or root access. Security researchers have also described application-dependent paths involving PHP-FPM. These details mean exposure depends on the runtime, configuration and deployment; a CMS update alone does not patch the PHP engine.
PHP2Shell, PHP Flaws & Dutch Site Outages
Two critical PHP vulnerabilities can enable unauthenticated remote code execution in affected deployments. Dutch authorities took three public services offline as a precaution; their announcement reported no confirmed compromise.
What PHP2Shell means
The flaws affect PHP’s request-processing runtime. Under certain conditions, interrupted processing can leave memory or internal state unsafe and lead to code execution.
Incomplete initialization
An out-of-memory failure can leave data incompletely initialized. PHP’s advisory describes demonstrated execution as the web worker account.
Stale memory references
In some conditions, request processing can leave references to memory that has already been freed.
Execution depends on setup
Unauthenticated remote code execution is possible in affected deployments. Worker-level access alone does not imply administrator or root access.
Where the runtime matters
Exposure depends on the PHP runtime, configuration, package source, and deployment. Updating a CMS does not patch the PHP engine.
Check the PHP workers
PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed among installations to assess.
Use a fixed package
Fixes were published for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Minimal source backports were also supplied for 7.4, 8.0, and 8.1.
Verify the backport
Distribution and extended-support packages may use different version strings. Ask the package vendor for the fixed release; an older version label alone does not prove a backport is absent.
From advisory to restoration
The reported Dutch shutdown came before patches were available. Later guidance focused on updating and keeping unpatched systems offline.
Oct 21 · Fixes issued
PHP published emergency security updates for both critical flaws.
Precautionary outage
Overheid.nl, MijnOverheid.nl, and DigiD were taken offline while patches were not yet available.
NCSC guidance
The Dutch NCSC urged organizations to update and said unpatched systems should remain offline as a precaution.
Verify, then restore
Operators need to confirm the fixed runtime is serving each site before bringing exposed services back online.
“Both vulnerabilities carry a CVSS v4.0 score of 9.2, Critical.”
PHP security advisoriesCloudflare reported attack traffic and attempts to alter payloads to evade protections.
Attempted exploitation observedReported attack attempts do not establish that the named Dutch services were targets or victims.
Evidence boundaryRisk is not proof of breach
Exploit demonstrations show potential impact in specific setups. They do not establish that every vulnerable deployment is exploitable in the same way—or that a particular service was accessed.
Reported evidence
- PHP advisories describe demonstrated exploitation on Apache with mod_php.
- Researchers described application-dependent paths involving PHP-FPM and demonstrations on WordPress, Drupal, and Joomla deployments.
- Cloudflare reported attack traffic and efforts to change payloads.
- Memory disclosure could expose sensitive process data such as credentials or tokens.
What remains unconfirmed
- No confirmed compromise of the named Dutch services was reported in the announcement.
- The announcement did not identify their exact PHP versions or configurations.
- Public information does not establish the full scale of exposure or whether other organizations were compromised.
- Many government sites, including Rijksoverheid.nl, were reported not to use PHP and were not affected by these specific flaws.
Patch the runtime. Confirm the service.
A CMS update alone is insufficient. The PHP runtime that serves requests must be fixed and verified.
Identify
Inventory the PHP runtime and package source behind each web-facing service.
Patch
Install a fixed upstream release or a vendor-confirmed backport.
Verify
Confirm the patched runtime—not just application code—is serving requests.
Restore
If unpatched, keep the system offline as a precaution. Restore service after patch status is confirmed.
Quick answers
What is PHP2Shell?
A name used for CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities that can lead to unauthenticated remote code execution under certain conditions.
Were the Dutch sites hacked?
The government said they were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. That is not confirmation of a breach.
Does updating WordPress fix it?
No. The PHP engine itself needs a fixed release or vendor-confirmed backport. Ask your hosting provider to confirm the runtime serving your site is patched.
Why PHP Runtime Patching Matters
The flaws affect the software layer that processes web requests, so patching a website’s themes or plugins is not enough. Operators need to establish which PHP runtime actually serves each site, apply an appropriate fixed package, and verify that the updated runtime is in use. For organizations relying on hosting providers, that means asking whether the provider patched the relevant PHP workers and when the change took effect.
The Dutch shutdowns show the service impact of responding to a serious vulnerability before a fix is available or deployment can be confirmed. Government services may be temporarily inaccessible as a precaution even when officials report no evidence of a breach. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to evade protections. That is evidence of attempted exploitation, not evidence that the named Dutch sites were breached.
Researchers reported demonstrations involving WordPress, Drupal and Joomla deployments, as well as possible disclosure of sensitive process memory. Those demonstrations concern the underlying PHP flaws, rather than separate vulnerabilities in each content-management system. Memory disclosure could expose data such as credentials or tokens, but the reported demonstrations do not establish that every vulnerable deployment has been accessed or that every instance is exploitable in the same way.
Products Worth Considering
Anker SOLIX C1000 Gen 2 Portable Power Station with 200W Solar Panel
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
As an affiliate, we earn on qualifying purchases.
How the Outages Followed the Advisory
The PHP security team published fixes on Oct. 21, 2026. The Dutch government said that same day that several services had been taken offline preventively, before patches were available. It reported no signs of active exploitation at the time of its announcement and said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. The sequence matters: the reported shutdown was a risk-management measure, while the subsequent alert addressed patching after fixes became available. Neither point establishes that the affected services experienced an intrusion.
Research accounts also describe AI tools being used during vulnerability discovery and analysis. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz reported independently discovering and reporting both vulnerabilities. Calif’s account says researchers directed the work using knowledge of PHP’s history; these are descriptions of research processes, not evidence that an AI system independently found or exploited every issue.
“The websites were taken offline as a precaution.”
— Dutch government announcement
Which Sites Were Actually Exposed
The Dutch government’s statement reported no signs of active exploitation at the time, but the available material does not provide a later forensic account of the sites taken offline or say when each service returned. It also does not identify the exact PHP versions and configurations those services used. The shutdown should not be treated as confirmation of a breach.
Cloudflare’s report of attack attempts does not identify the Dutch services as targets or victims. Researchers’ exploit demonstrations establish potential impact in specified setups, not that all listed server configurations can be exploited in the same way. The extent of exposure across public and private systems, and whether any other organizations were compromised, remains unclear.
Organizations using vendor-maintained or extended-support packages may receive fixes with version numbers that differ from PHP’s upstream releases. The source material does not provide a complete list of affected vendors or fixed package identifiers, so administrators need to consult the supplier responsible for their installation.
Patch Verification and Service Restoration
Operators should install the fixed PHP release or a vendor-confirmed backport, then verify that the patched runtime—not merely updated application code—is serving each affected site. Hosting customers should seek confirmation from their provider, particularly if they cannot inspect or control the server’s PHP configuration. Where a system remains unpatched, the Dutch NCSC guidance says it should stay offline as a precaution.
For the Dutch services, the next public update would need to clarify whether the sites have returned, what versions were running and whether any investigation found signs of access. The source material does not give a restoration timetable. Further guidance from PHP, the NCSC and affected providers may also clarify package availability and deployment-specific exposure.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, the flaws can lead to unauthenticated remote code execution.
Were the Dutch government websites hacked?
The government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution and reported no signs of active exploitation at the time of its announcement. That does not amount to a confirmed breach.
Does updating WordPress or another CMS fix the flaws?
No. The vulnerabilities are in the PHP runtime, not in WordPress, Drupal or Joomla themselves. The PHP software serving the site must be patched, including through a confirmed hosting-provider or vendor update where applicable.
Which PHP releases contain the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for 7.4, 8.0 and 8.1; users of vendor packages should check with their supplier for the fixed package.
What should site operators do now?
Install a fixed PHP release or vendor-confirmed backport and verify that it is the runtime handling web requests. If a provider manages the server, ask it to confirm patch status; according to Dutch NCSC guidance, systems that remain unpatched should stay offline as a precaution.
Source: ThorstenMeyerAI.com
