🔍 Read the full analysis: PHP2Shell, Critical PHP Flaws, And The Dutch Government Site Disruption on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency patches on 21 October 2026 for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. The Dutch government temporarily took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; it did not report confirmed compromises of those services.
PHP released emergency security updates on 21 October 2026 for two critical vulnerabilities that can let attackers execute code remotely without logging in, while the Dutch government took several public-service websites offline as a precaution. The affected sites included Overheid.nl, MijnOverheid.nl and DigiD; the government said its action was preventive, not confirmation that those services had been compromised.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively referred to in the source report as PHP2Shell. PHP’s security team identifies web-request-handling installations as potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Both advisories carry a CVSS v4.0 score of 9.2, rated Critical.
The vulnerabilities involve PHP’s handling of memory and internal state when request processing is interrupted. PHP’s advisories describe one flaw involving an out-of-memory failure and improperly initialized request data; the other involves stale internal references after request memory has been freed. Those conditions can lead to memory corruption or use-after-free behavior and, in vulnerable deployments, remote code execution. The out-of-memory advisory says demonstrated execution runs as the web worker account, which does not by itself mean an attacker has administrator or root access.
PHP published fixes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source report says PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations relying on distribution or extended-support packages should check their vendor’s security notice: an older-looking version number alone does not show whether a backport has been applied.
PHP2Shell, Critical PHP Flaws, and the Dutch Government Site Disruption
PHP released emergency fixes for two critical flaws that can enable unauthenticated remote code execution. Dutch authorities temporarily took several public-service sites offline as a precaution; they did not report confirmed compromises of those services.
CVSS v4.0 severity for vulnerabilities in PHP request handling.
Overheid.nl, MijnOverheid.nl and DigiD were taken offline; no confirmed breach of these named services was reported.
Tracked as CVE-2026-109618 and CVE-2026-109619
Emergency security updates released by PHP
PHP 8.5, 8.4, 8.3 and 8.2 releases
Named Dutch websites temporarily taken offline
Interruptions can corrupt runtime state
Both bugs involve PHP’s handling of memory and internal state when request processing is interrupted.
Out-of-memory failure
An allocation failure can leave request data improperly initialized. In vulnerable deployments, the resulting memory corruption may create a path to remote code execution.
Stale internal references
Request memory can be freed while internal references remain stale. That use-after-free behavior may enable remote code execution in affected configurations.
Why a runtime patch matters
Updating a content-management system or its plugins does not patch the PHP engine underneath it.
A request reaches a PHP installation handling web traffic.
An error path affects memory or internal request state.
Corruption or use-after-free may open an execution path.
Verify the fixed release or a vendor backport is serving the site.
Web request handlers
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are among the installation types identified by PHP’s security team. Actual exposure depends on deployment and configuration.
Fixed releases and vendor checks
Install a fixed release or confirm that your distribution or extended-support vendor has applied a verified backport.
Fixed upstream release
Fixed upstream release
Fixed upstream release
Fixed upstream release
Older branches: The source report says minimal source backports were also supplied for PHP 7.4, 8.0 and 8.1, which are outside normal upstream support. An older-looking version number alone does not reveal whether a vendor backport is present. Ask your provider which build is deployed and when it was patched.
Precaution is not proof of compromise
The shutdowns reduced exposure while authorities assessed risk. Separate reports of attack attempts do not establish a breach of the named services.
| What was reported | What it indicates | What it does not establish |
|---|---|---|
| Overheid.nl, MijnOverheid.nl and DigiD taken offline | Precautionary action | No confirmed compromise of these sites was reported |
| Dutch government statement on 21 October | No signs of active exploitation at that time | It does not prove every system was unaffected |
| Cloudflare observed attack traffic and payload changes | Exploitation attempts were observed broadly | It does not identify a successful attack on the named Dutch services |
| Many government sites, including Rijksoverheid.nl, did not use PHP | Not affected by these specific PHP flaws | It does not describe every public-sector system |
Patch, verify, then restore with evidence
Exposure varies by runtime, configuration and application path. Public reports leave several operational details unresolved.
Confirm the runtime
Check that the fixed PHP build is actually serving each site and covers every relevant web-request path. Updating WordPress, Drupal or Joomla alone is not enough.
Ask the provider
Request the deployed PHP version or backport, its application date and confirmation that all relevant environments are covered. Do not infer patch status from a visible application version.
Keep systems offline
The cited Dutch NCSC guidance says systems that remain unpatched should stay offline as a precaution. Test service operation after applying updates.
Restoration timing and full coverage
No timetable was given for restoring each Dutch service. The reports also do not establish the PHP configuration on every affected service or confirm successful attacks against the named websites. Continue monitoring and distinguish suspicious attempts from confirmed compromise.
Separate discovery from incident evidence
Research and disclosure accounts explain how the flaws came to light; they do not change what is known about the Dutch sites.
Multiple teams contributed
OpenAI said Calif identified a critical issue using GPT-5.6 Sol through Patch the Planet. Wiz independently discovered and reported both vulnerabilities.
Maintainers released fixes
PHP maintainers led the fixes and security release, with researchers and infrastructure providers contributing to the response.
Memory disclosure is also possible
Researchers reported a possible route to expose sensitive process memory, including credentials or tokens, even without achieving code execution.
Three claims, three distinct limits
Statements summarized in the source report provide context for the risk, observed activity and execution privileges.
“There were no signs of active exploitation at the time of the statement.”
“Attack traffic and attempts to change payloads to bypass protections were observed.”
“The demonstrated execution runs as the web worker account.”
Execution as a web worker does not by itself imply administrator or root access.
What operators and users should know
What is PHP2Shell?
It is the collective name used in the source report for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can enable remote code execution in vulnerable deployments.
Were the Dutch websites breached?
The available information does not establish a compromise of Overheid.nl, MijnOverheid.nl or DigiD. The government described the shutdowns as precautionary.
Does a CMS update fix this?
No. The flaw is in the PHP runtime. Confirm that the runtime serving the site received a fixed release or verified vendor backport.
What if the host manages PHP?
Ask the provider which version or backport is deployed, when it was applied, and whether all relevant request-handling paths are covered.
Why Runtime Patching Matters
These vulnerabilities sit in the PHP runtime beneath a website’s application. Updating a content-management system or its plugins does not patch the PHP engine, according to Cloudflare’s remediation guidance. Site owners need to establish whether the runtime serving each site has received the fix, including when hosting is managed by a provider.
The Dutch shutdowns show the operational consequences of treating a serious software flaw as a precautionary risk: public services can become unavailable even when authorities have not confirmed a breach. That distinction matters to users and organizations. A service taken offline to reduce exposure is not evidence that its data was accessed, while the absence of a reported compromise does not remove the need to patch.
Security research cited in the source material demonstrated potential effects across WordPress, Drupal and Joomla deployments. Those demonstrations concern vulnerabilities in PHP, not separate flaws in each content-management system. Researchers also reported a possible route to disclosure of sensitive process memory, which could expose credentials or tokens without achieving code execution. The practical exposure depends on the PHP deployment and configuration.
Products Worth Considering
FLEXISPOT 36-Inch Height-Adjustable Standing Desk Converter with Keyboard Tray, Black
FLEXISPOT Electric Adjustable Workbench, 55 x 28 Inches, White
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the Dutch Shutdown Unfolded
The Dutch government announced on 21 October that several websites, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline as a precaution. Its statement said there were no signs of active exploitation at the time. It also said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to modify payloads to bypass its protections. That report indicates attempts at exploitation; it does not establish that the named Dutch services were breached.
The source material also describes separate research efforts into the flaws. OpenAI said Calif identified a critical issue using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release, with researchers and infrastructure providers contributing. These accounts describe research and disclosure; they do not change what has been confirmed about the Dutch sites.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement, as reported by ThorstenMeyerAI.com
What Is Still Unconfirmed
The available information does not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised. The Dutch government reported no signs of active exploitation when it announced the precautionary shutdowns, while Cloudflare’s separate observations concerned attack attempts more broadly. The source material does not identify successful attacks against those named services.
It is also not clear from the reported announcements exactly when each site would return, which PHP configurations were present on every affected service, or whether all relevant systems had been patched and tested. Exposure can differ by runtime, configuration and application path. PHP-FPM, for example, handles some startup failures differently from mod_php, but the research cited in the source report describes application-dependent exploitation paths involving PHP-FPM; that difference is not proof of immunity.
Organizations using managed hosting may not control the runtime directly. The source material does not list which providers have applied fixes or how quickly every customer environment will receive them. Operators should seek confirmation from their host or software vendor rather than infer patch status from a website’s visible application version.
Patch Status and Service Restorations
The immediate next steps are for operators to install the fixed PHP release or a verified vendor backport, then confirm the patched runtime is actually serving each site. Organizations unable to update should follow the Dutch NCSC’s cited precautionary guidance and keep affected systems offline until they can establish their status. Updating WordPress, Drupal or Joomla alone does not address a flaw in PHP itself.
Website owners using managed hosting should ask their provider which PHP version or backport is deployed, when it was applied, and whether all relevant web-request paths are covered. Providers and organizations also need to test that services operate as expected after updates. For Dutch public services, the source material gives no restoration timetable; the next confirmed information would be an official update on patching and availability.
Security teams should continue to distinguish attempted exploitation from confirmed compromise and review relevant monitoring for suspicious activity. The source material reports attack attempts observed by Cloudflare but provides no confirmed incident findings for the named Dutch websites. Further statements from government agencies, PHP maintainers or hosting vendors may clarify service restoration and patch coverage.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used in the source report for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under vulnerable conditions, they can lead to remote code execution without an attacker logging in.
Were the Dutch government websites confirmed to be hacked?
No confirmed compromise of Overheid.nl, MijnOverheid.nl or DigiD is reported in the source material. The Dutch government said the websites were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement.
Which PHP versions contain the fixes?
The reported fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source also says minimal backports were supplied for PHP 7.4, 8.0 and 8.1. Users of vendor-managed packages should check their supplier’s advisory because a backport may not be apparent from the version number alone.
Does updating a website’s plugins fix these vulnerabilities?
No. The flaws affect the PHP runtime, not just the website application or its plugins. The runtime serving the site must be patched, either by the operator or by its hosting provider.
Are all PHP installations vulnerable?
The PHP security team identifies installations handling web requests as at risk, across several runtime setups. Actual exposure depends on the runtime, configuration and application. A setup that handles some failure conditions differently should not be treated as immune without checking the relevant advisory and vendor guidance.
Source: ThorstenMeyerAI.com
