🔍 Read the full analysis: PHP2Shell Exposes Critical PHP Flaws As Dutch Government Websites Go Offline on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency fixes on 21 October 2026 for two critical vulnerabilities that could allow unauthenticated remote code execution. Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; the government said it had no signs of active exploitation at the time of its announcement and did not report those services as compromised.
PHP released emergency security updates on 21 October 2026 for two critical vulnerabilities that can enable unauthenticated remote code execution, prompting the Dutch government to take several public websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution. The government said it had no signs of active exploitation at the time of its announcement; it did not say the affected services had been compromised.
The flaws, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated Critical. The issues affect PHP installations handling web requests, including configurations using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The vulnerabilities involve separate failures in PHP’s handling of internal memory and request state. In one, an out-of-memory failure can interrupt an operation before request data is fully initialized, leaving cleanup code to handle invalid data. In the other, internal state can retain references to request memory that has already been freed. The resulting memory corruption or use-after-free conditions can, under affected configurations, lead to remote code execution.
PHP published fixed releases for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using vendor-maintained or extended-support packages need to check with their provider for a fixed build; a version number alone may not show whether a backport has been applied.
Security briefing · 21 October 2026
PHP2Shell Exposes Critical PHP Flaws As Dutch Government Websites Go Offline
PHP issued emergency fixes for two critical vulnerabilities that can enable unauthenticated remote code execution. Dutch authorities took several public websites offline as a precaution; the government reported no signs of active exploitation at the time of its announcement.
01 / What happened
A runtime flaw with a public-service impact
PHP2Shell refers to two separate failures in PHP’s handling of memory and request state. Depending on configuration, these conditions can corrupt memory and lead to code execution.
Incomplete request setup
An out-of-memory failure can interrupt an operation before request data is fully initialized. Cleanup code may then process invalid data, creating a path to memory corruption.
Stale memory references
Internal state can retain references to request memory that has already been freed. The resulting use-after-free may be exploitable under affected configurations.
02 / The response
Precaution first, then patch verification
The Dutch government said it saw no signs of active exploitation when it announced the shutdowns. The NCSC later urged organizations to update and said unpatched systems should remain offline.
PHP releases fixes
Emergency security updates published on 21 October 2026.
Services taken offline
Named Dutch government websites removed from public access as a precaution.
Operators assess runtime
Check actual PHP builds and configurations across exposed services.
Patch and verify
Keep systems offline until fixed software is serving requests.
“The websites were taken offline as a precaution.”
Dutch government announcement“There were no signs of active exploitation at the time of the statement.”
Dutch government announcementCloudflare reported attack traffic and attempts to alter payloads to bypass protections.
Observed attempts do not confirm a successful attack on the named services03 / Fixed versions
Update the PHP runtime behind the site
CMS and plugin updates alone do not fix a vulnerable PHP installation. Confirm the runtime serving each site has received and loaded a fixed build.
| PHP branch | Fixed release | Operator action |
|---|---|---|
| 8.5 | 8.5.12 | Update and verify active runtime |
| 8.4 | 8.4.27 | Update and verify active runtime |
| 8.3 | 8.3.36 | Update and verify active runtime |
| 8.2 | 8.2.35 | Update and verify active runtime |
| 7.4, 8.0, 8.1 | Source backports provided | Check vendor or extended-support package |
A version number alone may not show whether a vendor backport has been applied. Managed-hosting customers should ask their provider which PHP build serves each site.
04 / Impact and limits
Serious exposure does not equal confirmed compromise
The available statements describe vulnerability, precautionary shutdowns and observed attack attempts. They do not establish unauthorized access to the named Dutch services.
Web worker account
For the out-of-memory flaw, PHP says code execution runs as the web worker account. That alone does not mean administrator or root access.
Sensitive process memory
Researchers demonstrated that memory could be exposed in some circumstances, potentially revealing credentials or tokens without code execution.
No confirmed breach stated
The government reported no signs of active exploitation at announcement time. Cloudflare’s report of attempts does not prove a successful attack on these services.
05 / Operator checklist
Patch the layer that handles the request
Map PHP installations
Inventory public-facing services, runtime branches and request-handling configurations.
Apply a fixed package
Use the listed fixed release or obtain a patched build from the distribution or hosting provider.
Confirm it serves traffic
Check the running runtime, not only the application dashboard or installed package metadata.
Follow NCSC guidance
Keep unpatched systems offline as a precaution while remediation is incomplete.
Track official updates
Watch provider advisories and distinguish reports of attempted attacks from confirmed compromise.
Wait for service status
No restoration timetable was provided in the source material for the affected Dutch websites.
06 / Key questions
What operators and users should know
What is PHP2Shell?
Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory and request-state failures that can enable remote code execution in affected configurations.
Were the Dutch websites hacked?
The government said the shutdowns were precautionary and reported no signs of active exploitation at announcement time. The available information does not confirm compromise.
Does updating WordPress fix it?
No. The flaws are in the PHP runtime. Operators must verify that the PHP software serving the site has been patched.
When will services return?
The source material gives no restoration timetable. Further government or NCSC updates may clarify service status.
Why PHP Runtime Patching Matters
The vulnerabilities sit in the PHP runtime, below content-management systems and website plugins. Updating WordPress, Drupal or Joomla alone does not fix a vulnerable PHP installation. Operators need to confirm that the runtime serving each site has been patched and that the patched service is actually handling requests. For managed hosting customers, that means checking with the provider rather than relying on an updated application dashboard.
The potential impact is serious but should be described precisely. PHP’s advisories report demonstrated exploitation on Apache with mod_php. For the out-of-memory flaw, the advisory says code execution runs as the web worker account; that does not by itself mean an attacker gains administrator or root access. Researchers also demonstrated that sensitive process memory could be disclosed in some circumstances, potentially exposing credentials or tokens without achieving code execution.
The shutdowns show how a suspected weakness in widely used server software can affect access to public services even when there is no confirmed breach. Taking sites offline can limit exposure while operators assess risk and apply fixes, but it also interrupts access to government information and services. The Dutch action was described as preventive, not as a response to a confirmed compromise of the named sites.
As an affiliate, we earn on qualifying purchases.
How the Dutch Response Unfolded
On 21 October, the Dutch government said several websites had been taken offline as a precaution because of the PHP vulnerabilities. It also said there were no signs of active exploitation at the time of that statement. The government noted that many other government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass its protections. That report concerns observed attempts; it does not establish that the Dutch services named by the government were successfully attacked.
Researchers described exploitation paths across different setups, so exposure depends in part on the PHP runtime and configuration. Wiz reported demonstrations involving WordPress, Drupal and Joomla deployments, but characterized the underlying issue as a PHP engine flaw rather than separate vulnerabilities in each content-management system. The discoveries and analysis also involved security researchers and AI tools, while PHP maintainers led the fixes and release.
“The websites were taken offline as a precaution.”
— Dutch government announcement
What Is Not Yet Confirmed
The available statements do not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised, nor do they provide evidence of unauthorized access to those services. The government’s assessment was that there were no signs of active exploitation when it announced the shutdowns; that assessment is tied to the time of the statement, while Cloudflare separately reported attack attempts.
It is also not clear from the source material when each offline website will return, which specific PHP configurations were in use at each service, or whether all affected operators have completed patching. Reports of successful demonstrations on certain configurations do not mean every PHP deployment is equally exposed. Operators should rely on their actual runtime, configuration and vendor’s patch status rather than assuming a platform is safe or affected based only on its website application.
Patching Before Services Return
PHP operators should apply the fixed release for their supported branch, or obtain a patched package from their distribution or hosting provider, then verify that the updated runtime is serving requests. Those responsible for public-facing services should follow Dutch NCSC guidance and keep systems offline if they remain unpatched. Managed-hosting customers can ask providers directly which PHP versions and sites have been updated.
The next public milestone is the return of the affected Dutch services and any further government or NCSC update on their status. The source material does not provide a restoration timetable. Organizations should also monitor provider advisories for fixed packages and check for later official information about exploitation or remediation, while distinguishing reports of attempted attacks from confirmed compromise.
Key Questions
What are the PHP2Shell vulnerabilities?
They are two PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP says memory-management and request-state failures can lead to remote code execution in affected configurations.
Were the Dutch government websites hacked?
The Dutch government said it took several websites offline as a precaution and reported no signs of active exploitation at the time of its announcement. The available information does not confirm that the named services were compromised.
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP runtime, so updating a site’s CMS or plugins alone does not resolve them. Operators must verify that the PHP software serving the site has been patched.
Which PHP versions include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied source backports for 7.4, 8.0 and 8.1; users of vendor-supported packages should confirm the fix with their provider.
When will the affected Dutch websites return?
No restoration timetable is provided in the available statements. The Dutch NCSC urged organizations to keep unpatched systems offline, so timing depends on remediation and the authorities’ decisions.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
