🔍 Read the full analysis: How Critical PHP Flaws And PHP2Shell Coincided With Dutch Site Downtime on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency fixes on Oct. 21, 2026, for two critical vulnerabilities that can permit remote code execution without authentication. Dutch authorities said several public websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution; the government reported no signs of active exploitation at the time of its statement.
PHP released emergency updates on Oct. 21 for two critical vulnerabilities that can allow unauthenticated remote code execution, while Dutch authorities took several public websites offline as a precaution. The government named Overheid.nl, MijnOverheid.nl and DigiD among the affected services, but said its action was preventive and reported no signs of active exploitation when it issued its statement.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and are collectively referred to as PHP2Shell in the source reporting. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated Critical. The defects involve how PHP handles internal memory and state when request processing is interrupted, creating conditions that researchers say can lead to memory corruption or use-after-free errors and, in some configurations, remote code execution.
PHP issued fixed releases for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, though the release guidance also describes minimal source backports for versions 7.4, 8.0 and 8.1. Organizations using vendor-maintained or extended-support packages are advised to obtain the vendor’s fixed build; a version string alone may not show whether a backport has been applied.
The Dutch government’s announcement described taking services offline before patches were available, not finding that those services had been compromised. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update. Its guidance says systems that have not been patched should remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections; that report does not establish a breach of the named Dutch services.
Security briefing · October 21, 2026
How Critical PHP Flaws and PHP2Shell Coincided With Dutch Site Downtime
Emergency fixes for two critical PHP vulnerabilities arrived as Dutch authorities took several public services offline as a precaution. The government reported no signs of active exploitation when it issued its statement.
01 / The vulnerabilities
What PHP2Shell refers to
The reported defects involve PHP’s handling of internal memory and state when request processing is interrupted. In affected circumstances, this can create memory corruption or use-after-free conditions that may lead to remote code execution.
No login required
The flaws can permit unauthenticated remote code execution on vulnerable deployments. Actual risk depends on the runtime, configuration and application.
Web worker context
PHP’s advisory describes a demonstrated execution path running as the web worker account. That does not automatically grant administrator or root access.
Configuration matters
Web-request setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. No single configuration detail proves every system safe or exposed.
02 / Why runtime patching matters
Application updates do not patch PHP
PHP is the runtime processing website requests. Updating WordPress, Drupal, Joomla or plugins does not itself update the PHP software beneath them. Operators need to verify that the patched runtime is serving live traffic.
For third-party hosting, ask the provider which PHP build is running, whether the fixes are included, and whether any sites remain exposed.
A version string may not reveal whether a vendor backport has been applied. Confirm the package status with the operating system, host or extended-support provider.
03 / Fixed releases
Patch the PHP build serving requests
PHP published fixed releases for supported branches. Older installations and vendor-maintained packages need specific verification.
| PHP branch | Fixed release | Operator action |
|---|---|---|
| 8.5 | 8.5.12 | Upgrade to the fixed release or later patched build |
| 8.4 | 8.4.27 | Upgrade to the fixed release or later patched build |
| 8.3 | 8.3.36 | Upgrade to the fixed release or later patched build |
| 8.2 | 8.2.35 | Upgrade to the fixed release or later patched build |
| 7.4, 8.0, 8.1 | Backports may be available | Check vendor or extended-support package status |
PHP 8.1 and earlier are outside normal upstream support. Release guidance also describes minimal source backports for versions 7.4, 8.0 and 8.1; obtain a fixed vendor build where applicable.
04 / Dutch service response
A precautionary shutdown, then patch guidance
The government said services were taken offline before patches were available. Its statement reported no signs of active exploitation at that time.
Critical flaws disclosed
Two PHP vulnerabilities were tracked as CVE-2026-109618 and CVE-2026-109619.
Services taken offline
On October 21, authorities named these sites as precautionary shutdowns:
Fixes became available
PHP issued patched releases; the Dutch NCSC advised organizations to update.
Unpatched systems stay offline
NCSC guidance says systems that have not been patched should remain offline as a precaution.
The government also said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
05 / What is known
Keep the evidence in view
Available reporting describes risk and response, but leaves key questions about service configurations and later outcomes unanswered.
The government reported no signs of active exploitation when it issued its statement. That does not establish what happened later or prove every system was free of compromise. Cloudflare reported attack traffic and attempted protection bypasses; that report does not identify a successful intrusion into the named services.
Whether the named Dutch services later returned online or which PHP configurations they used.
Whether every affected system was patched or whether later investigations found activity.
Exposure varies by runtime, configuration and application. Confirm software and hosting status directly.
06 / Operator checklist
Verify, patch, confirm
Find the live runtime
Inventory PHP installations and request-handling configurations behind each site.
Apply the fixed build
Install the upstream release or a vendor-maintained package with the fixes included.
Check service and records
Verify the patched runtime serves live requests. Review logs and security records for suspicious activity.
Why PHP Runtime Patching Matters
The episode highlights that a vulnerability in the PHP runtime is distinct from a flaw in a website’s content management system. Updating WordPress, Drupal or Joomla, or installing application plugins, does not by itself patch the PHP software processing requests. Operators need to verify the runtime that actually serves each site has received the fix.
The distinction matters for public agencies, businesses and hosting customers because the vulnerable runtime can sit beneath many separate applications. A provider may manage the server-side PHP installation, leaving a site owner unable to confirm patch status from a website dashboard. Organizations should ask their hosting provider which PHP build is running, whether the relevant fixes are included, and whether any sites remain exposed.
Research cited in the source material demonstrated unauthenticated code execution on certain deployments and potential disclosure of sensitive process memory, including credentials or tokens. PHP’s advisory says one demonstrated execution path runs as the web worker account; this does not automatically mean administrator or root access. The actual impact depends on the environment and configuration.
PHP security patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Dutch Shutdown Unfolded
The Dutch government said on Oct. 21 that it had taken several services offline as a precaution in response to the PHP vulnerabilities. Its statement said there were no signs of active exploitation at that time. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The technical risk is not identical across every PHP setup. PHP identifies web-request installations—including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed—as relevant to exposure assessment. Research cited by the source material demonstrated attacks against Apache with mod_php. While PHP-FPM handles some startup failures differently, research also describes application-dependent exploitation paths involving PHP-FPM, so that configuration should not be treated as automatically safe.
The disclosure also involved security researchers and AI-assisted work. The source material says OpenAI credited Calif with identifying a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers issued the fixes. The research accounts describe AI tools as part of a process led by researchers, rather than as a substitute for technical expertise.
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The available material does not say whether the Dutch services were subsequently brought back online, which PHP configurations each service used, or whether every affected system has now been patched. The government’s statement reported no signs of active exploitation at the time; it does not establish that no attempts occurred later or that every system was free of compromise.
Cloudflare’s observations concern attack traffic and attempted bypasses, but they do not identify a successful intrusion into the named government services. The source material also does not provide a complete list of affected Dutch sites, a count of exposed installations, or a confirmed impact assessment for organizations outside those named.
Risk varies with the runtime, configuration and application. The reported demonstrations show that some deployments can be exploited, while they do not prove that every PHP installation is vulnerable in the same way. Operators need to confirm their software and hosting status rather than infer exposure from the presence of a particular website platform.
PHP memory corruption debugging tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Returns
Organizations running PHP should apply the fixed release for their supported branch, or obtain a patched package from their operating-system, hosting or extended-support vendor. They should then verify that the patched runtime—not merely updated application code—is the one serving live requests. Where a system remains unpatched, Dutch NCSC guidance says it should stay offline as a precaution.
For sites hosted by a third party, the next practical step is to obtain confirmation of the PHP version and patch status from the provider. Operators may also need to review logs and other security records for suspicious activity, but the source material does not set out a specific incident-response finding for the Dutch services. Further official statements would be needed to confirm when the affected sites return and whether authorities later identify any compromise.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to have been hacked?
No. The government said the named sites were taken offline as a precaution and reported no signs of active exploitation at the time of its statement. That does not confirm whether later investigations found any activity.
What is PHP2Shell?
In the source material, PHP2Shell refers collectively to CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities. PHP’s advisories say the flaws can lead to unauthenticated remote code execution in affected circumstances.
Does updating WordPress fix these vulnerabilities?
No. The flaws are in the PHP runtime, which processes the website’s requests. Updating WordPress, Drupal, Joomla or plugins does not replace patching the PHP version running the site.
Which PHP releases contain the fixes?
The releases listed in the source material are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users on older or vendor-supported builds should check with their package or hosting provider because backports may not be reflected by the version number alone.
Does using PHP-FPM mean a site is safe?
Not necessarily. PHP-FPM handles some failure paths differently from Apache with mod_php, but cited research also describes application-dependent exploitation paths involving PHP-FPM. Operators should check their exact runtime, configuration and patch status.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
