🔍 Read the full analysis: PHP2Shell Sparks Questions About PHP Flaws And Dutch Website Availability on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released security updates on 21 October 2026 for two critical vulnerabilities that can enable unauthenticated remote code execution. Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; the government said it had no signs of active exploitation affecting those services at the time of its announcement.
PHP released emergency security updates on 21 October for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow attackers to run code remotely without logging in. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not report confirmed compromises of those services.
PHP’s security advisories describe both vulnerabilities as risks to installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Each advisory carries a CVSS v4.0 score of 9.2, rated Critical. The flaws involve mishandled internal memory or request state: one follows an out-of-memory failure, while the other involves references to memory that has already been freed.
PHP published fixes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release information also says minimal source backports were provided for PHP 7.4, 8.0 and 8.1. Operators using distribution packages or extended-support versions need to check with their supplier for a fixed build; an older version number by itself does not show whether a backport is included.
The Dutch government described the shutdowns as preventive measures and said it had no signs of active exploitation when it issued its statement. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update; its guidance says systems not yet updated should remain offline as a precaution. The government also said many other sites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
Patch the PHP Runtime, Not Just the Site
The vulnerabilities sit in the PHP runtime, the software that processes requests for many websites. Updating WordPress, Drupal or Joomla code and plugins alone will not repair a vulnerable PHP installation. Website operators need to establish which runtime and version serve each site, then confirm that the host or internal team has installed a fixed package.
The consequences described in the advisories go beyond a temporary outage: successful exploitation can lead to remote code execution without authentication. PHP says demonstrated exploitation on Apache with mod_php can run as the web worker account. That does not, by itself, mean an attacker gains administrator or root privileges. Wiz also reported demonstrations involving sensitive process-memory disclosure, which could expose credentials or tokens even without code execution.
For people relying on Dutch digital public services, the immediate effect is availability: precautionary shutdowns can interrupt access while agencies assess exposure and apply patches. The distinction matters. A service being taken offline is evidence of a protective response, not proof that attackers breached it. Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections, but that does not establish that the named Dutch services were compromised.
As an affiliate, we earn on qualifying purchases.
Two Flaws, Different Failure Paths
The source advisories describe CVE-2026-109618 as a problem that can arise when an out-of-memory failure interrupts an operation before internal request data is fully initialized. Cleanup may then handle invalid data as if it were valid, causing memory corruption that can lead to remote code execution. CVE-2026-109619 concerns internal state retaining references after the memory those references point to has been freed; a later request can encounter those stale references.
Research cited in the source material shows why the PHP setup matters. Demonstrated attacks included Apache with mod_php, and some mod_php paths occur before application code runs. PHP-FPM handles certain startup failures differently, but that is not evidence that every PHP-FPM deployment is safe: Calif described application-dependent exploitation paths involving PHP-FPM. Exposure depends on the runtime, configuration and application, so operators should follow the advisory and their vendor’s instructions rather than infer safety from a single deployment detail.
The discovery accounts also point to AI-assisted security research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative; Wiz independently discovered and reported both vulnerabilities. The source material attributes the fixes and release to PHP maintainers, with support from researchers and infrastructure providers. Calif said its initial discovery used generally available models and that the researcher guided the investigation using knowledge of PHP’s vulnerability history.
“Both vulnerabilities have a CVSS v4.0 score of 9.2, rated Critical.”
— PHP security advisories
As an affiliate, we earn on qualifying purchases.
Breach Status and Host Patches
The available source material does not establish whether any attacker successfully exploited either flaw against the Dutch services, or whether the shutdowns prevented a specific attack. The government said it had no signs of active exploitation at the time of its announcement, while Cloudflare reported observing attack traffic more broadly. Those statements concern different evidence and do not confirm a compromise of Overheid.nl, MijnOverheid.nl or DigiD.
It is also not clear from the material when each affected service will return, which hosting providers have completed updates, or how many installations remain exposed. A managed-hosting customer may not control the PHP runtime directly, and a website’s application dashboard does not confirm that the underlying runtime is patched. Organizations should seek confirmation from their hosting provider or package vendor.
As an affiliate, we earn on qualifying purchases.
Verify Fixes Before Restoring Service
Organizations should identify the PHP runtime and branch serving each website, install the applicable fixed release or vendor backport, and verify that the patched runtime is actually handling requests. The Dutch NCSC’s published guidance calls for systems that remain unpatched to stay offline as a precaution. Service operators will also need to determine when their own checks support restoring access; the source material gives no general reopening timetable.
For managed hosting, the next step is to ask the provider whether the PHP runtime serving each affected site has been patched and how that status was verified. Security teams should assess logs and other available evidence for possible exploitation, while keeping observed attack attempts separate from proof of a successful intrusion. Further details about service restoration, confirmed incidents or vendor fixes may change the current picture.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP’s advisories say each can lead to remote code execution under affected conditions.
Were the Dutch websites confirmed to be hacked?
No confirmed compromise was reported in the source material. The Dutch government said it took several sites offline as a precaution and had no signs of active exploitation at the time of its announcement. Cloudflare’s report of attack traffic does not establish that those named services were breached.
Does updating WordPress or another CMS fix the issue?
No, not by itself. The flaws affect the PHP runtime beneath a site. Operators need to update that runtime or confirm that their hosting provider has installed a fixed package; CMS and plugin updates do not substitute for PHP remediation.
Which PHP versions include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source material also says minimal source backports were provided for versions 7.4, 8.0 and 8.1. Users of vendor or extended-support packages should check that supplier’s fixed release information.
When will the affected Dutch services return?
No restoration schedule is provided in the source material. The government and service operators would need to assess patching and operational readiness before reopening the affected sites.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
