🔍 Read the full analysis: PHP2Shell Highlights PHP Flaws During Dutch Government Website Outages on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

PHP released emergency security updates on October 21 for two critical vulnerabilities, dubbed PHP2Shell, that can allow unauthenticated remote code execution. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; it reported no signs of active exploitation at the time of its announcement, and did not say the services had been compromised.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe problems involving internal memory and request state when processing is interrupted. One flaw can leave data incompletely initialized after an out-of-memory failure; the other can leave internal references pointing to memory that has already been freed. Both conditions can lead to memory corruption and remote code execution.

PHP assigned each issue a CVSS v4.0 score of 9.2, rated Critical. Its advisories report demonstrated exploitation on Apache with mod_php. The out-of-memory advisory says execution would run as the web worker account, which does not automatically give an attacker administrator or root privileges. Research cited by Calif also describes application-dependent exploitation paths involving PHP-FPM; differences in how a server handles a failure do not establish that it is safe.

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also issued minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using distribution packages or extended support should check with their supplier: a version number alone may not show whether a vendor has included a backport.

Why Runtime Patching Matters

PHP2Shell affects the PHP runtime that handles web requests, rather than a particular content management system. PHP identifies PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the installations that may be at risk. The relevant question for a site owner is whether the PHP software serving the site has been patched—not simply whether the site’s application or plugins are up to date.

The Dutch shutdown illustrates the operational consequences of responding to a serious vulnerability before services can be confirmed safe. The National Cyber Security Centre said patches were available and advised organizations to keep systems that have not been updated offline as a precaution. That guidance may mean downtime for public services and businesses, but the available statements do not establish that every affected installation was attacked or that every outage was caused by a compromise.

Cloudflare reported observing attack traffic and attempts to alter payloads to get around protections. Those observations support concern about attempted exploitation more broadly, but do not establish a successful attack against the Dutch sites named by the government. Keeping attempted attacks distinct from confirmed breaches is important for understanding the incident and judging the response.

How the Dutch Shutdown Unfolded

On October 21, the Dutch government announced that several websites, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline preventively. Its statement said there were no signs of active exploitation at that point. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were unaffected by these specific vulnerabilities.

The National Cyber Security Centre later confirmed patches were available and urged organizations to update. PHP’s release guidance lists fixes across supported branches and source backports for some older versions. Operators using third-party hosting or vendor-maintained packages need to confirm which runtime version is actually deployed and whether the provider has applied a fixed package.

Security researchers have described potential effects beyond code execution. Wiz reported demonstrations of unauthenticated code execution against WordPress, Drupal and Joomla deployments, as well as possible disclosure of sensitive process memory, including credentials or tokens. These are demonstrations of flaws in the PHP engine, not separate vulnerabilities in those content management systems. Updating a CMS or its plugins alone does not patch PHP.

“The websites were taken offline as a precaution; the announcement said there were no signs of active exploitation at that time.”

— The Dutch government

Breach Status Remains Unconfirmed

The available government statement does not confirm that Overheid.nl, MijnOverheid.nl or DigiD were compromised, and it reports no signs of active exploitation at the time it was issued. Cloudflare’s observations of attack traffic do not resolve whether any specific Dutch system was targeted successfully. The supplied information also does not state when each service would return online or whether later investigations changed the initial assessment.

Exposure depends on the PHP runtime, configuration and, in some cases, the application. The public information does not provide a complete inventory of vulnerable Dutch systems, the number of affected organizations, or the extent to which providers had patched their customers’ environments. Older version numbers may include vendor backports, so operators need confirmation from their package provider rather than relying on the version label alone.

Patch Verification and Service Restarts

Operators should apply the fixed PHP release or obtain a patched package from their distribution or hosting provider, then verify that the updated runtime is actually serving each affected website. The Dutch NCSC’s published guidance says systems that have not been updated should remain offline as a precaution. Decisions to restore services will depend on the responsible operators’ patching and security checks; no return-to-service timetable was included in the supplied announcements.

Organizations should also distinguish an application update from a PHP runtime update and confirm the status of managed hosting directly with their provider. Further government or security advisories may clarify the investigation and service availability. Until those details are published, the confirmed picture is limited: critical PHP fixes are available, several Dutch public services were taken offline preventively, and the cited government statement did not confirm a breach.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says both can lead to unauthenticated remote code execution in vulnerable installations.

Were the Dutch government websites hacked?

The government said it took several services offline as a precaution and reported no signs of active exploitation when it made its announcement. The supplied information does not confirm that the named sites were compromised.

Which PHP versions contain fixes?

The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for 7.4, 8.0 and 8.1; users of vendor-maintained packages should check with their supplier.

Will updating WordPress or another CMS fix the flaws?

No. The vulnerabilities are in the PHP runtime, so updating a CMS or its plugins alone does not address them. Site operators should confirm that the PHP software serving the site has been patched.

Does PHP-FPM mean a site is safe?

No. Differences in how PHP-FPM handles certain failures do not establish immunity. Research cited in the source material describes application-dependent PHP-FPM exploitation paths, so operators should patch and assess their particular setup.

Source: ThorstenMeyerAI.com