🔍 Read the full analysis: PHP2Shell And Dutch Website Outages: Examining The Critical PHP Flaws on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released security updates on October 21, 2026, for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Dutch authorities temporarily took several public websites offline as a precaution; that action does not confirm those sites were compromised. Operators need to patch the PHP runtime itself and verify that fixed software is serving each site.
PHP released emergency security updates on October 21 for two critical flaws that can let an attacker execute code remotely without logging in, while the Dutch government temporarily took several public websites offline as a precaution. The shutdown included Overheid.nl, MijnOverheid.nl and DigiD, but the government announcement did not say those services had been compromised.
The vulnerabilities, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated critical. They affect PHP installations processing web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The flaws involve PHP’s handling of memory and internal request state. In CVE-2026-109618, an out-of-memory failure can interrupt an operation before request data is fully initialized, after which cleanup may treat invalid data as valid. CVE-2026-109619 involves stale internal references that persist after the memory they point to has been freed. Both conditions can lead to remote code execution, according to the advisories.
PHP’s fixes are in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1; organizations relying on distribution or extended-support packages should check with their vendor for a fixed package. A version string alone may not show whether a vendor has applied a backport.
Security briefing · October 21, 2026
PHP2Shell And Dutch Website Outages
Two critical PHP runtime flaws can enable unauthenticated remote code execution. Dutch authorities temporarily took several public services offline as a precaution. That action does not confirm those services were compromised.
What the shutdown means
Precautionary downtime signals uncertainty, not proof of a breach.
The Dutch announcement reported no signs of active exploitation at that time.Critical · each flaw
PHP2Shell
01 / The vulnerabilities
Small runtime failures, serious consequences
Both flaws affect PHP while it processes web requests. They concern memory handling and internal request state, and can lead to remote code execution.
Out-of-memory / unsafe cleanup
Incomplete request state
An out-of-memory failure can interrupt an operation before request data is fully initialized. Cleanup may then treat invalid data as valid, creating a path to code execution.
Stale internal references
References outlive memory
Internal references can persist after the memory they point to has been freed. The advisory says this condition can also lead to remote code execution.
02 / Why runtime patching matters
Patch the software serving the site
The vulnerabilities are in PHP itself. Updating a content management system or its plugins does not update the runtime underneath it.
Runtime layer
PHP executes requests
Apply the fixed PHP release for the active branch, or install a fixed package supplied by the operating system or extended-support vendor.
Application layer
CMS updates are separate
WordPress, Drupal, Joomla, and their plugins are not the vulnerable component. Application updates alone do not remediate PHP2Shell.
Hosting layer
Verify what serves traffic
Ask managed hosts to confirm the corrected runtime is active for each affected site. A version string alone may not show whether a vendor backport was applied.
03 / Dutch shutdown
What is known—and what is not
The outage was a precaution while operators assessed exposure. Public statements do not establish successful attacks against the named services.
Services named
Temporary downtime
Overheid.nl, MijnOverheid.nl, and DigiD were among the public websites taken offline. The announcement did not say they had been compromised.
Government statement
No signs reported then
The Dutch government said there were no signs of active exploitation at the time of its statement. It also said many sites, including Rijksoverheid.nl, did not use PHP.
Separate observations
Attempts are not breaches
Cloudflare observed attack traffic and attempts to alter payloads to bypass protections. Those observations do not establish a successful attack on the Dutch services.
“There were no signs of active exploitation at the time of the statement.”
Dutch government announcement, as reported by ThorstenMeyerAI.com“Updating website code or plugins alone does not resolve the vulnerabilities.”
Cloudflare remediation guidance04 / Response timeline
From disclosure to verified service
PHP maintainers led the fixes. Security researchers and AI tools also contributed to discovery, analysis, and validation.
Critical flaws disclosed
Two PHP issues were tracked as CVE-2026-109618 and CVE-2026-109619.
October 21 · services paused
Dutch public websites were taken offline preventively as operators assessed risk.
PHP fixes released
Emergency updates and minimal source backports became available; NCSC urged organizations to update.
Patch and verify
Confirm the patched runtime is serving every site. NCSC guidance says unpatched systems should remain offline.
05 / Fixed releases
Match the patch to the PHP branch
Organizations using distribution or extended-support packages should confirm the applicable fixed package with their vendor.
| PHP branch | Fixed release | Operator note |
|---|---|---|
| 8.5 | 8.5.12 | Update runtime and verify active service. |
| 8.4 | 8.4.27 | Update runtime and verify active service. |
| 8.3 | 8.3.36 | Update runtime and verify active service. |
| 8.2 | 8.2.35 | Update runtime and verify active service. |
| 7.4, 8.0, 8.1 | Minimal source backports | Check vendor package and support status. |
Restart and confirm
Ensure the updated PHP runtime is the one handling requests for each affected website. Confirm service status with the hosting provider where applicable.
Unpatched systems
Keep systems offline while they remain unpatched, following Dutch NCSC guidance. Assess runtime configuration rather than relying on CMS update status.
06 / Traceability
Follow the risk to the right fix
A clear response connects the vulnerable component, exposure assessment, remediation, and service validation.
07 / Key questions
What operators should know
Reported exposure varies by PHP version, configuration, and hosting arrangement. Public information does not provide a complete count of vulnerable systems or confirmed compromises.
What are the PHP2Shell vulnerabilities?
PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619. Both critical flaws can lead to remote code execution without authentication.
Were the Dutch websites hacked?
The government took several sites offline as a precaution and reported no signs of active exploitation at that time. The shutdown itself is not evidence of a successful attack.
Will a WordPress or plugin update fix PHP2Shell?
No. The flaws are in the PHP runtime. Update PHP itself or confirm the hosting provider has installed the corrected runtime.
Are all PHP-FPM sites vulnerable in the same way?
No. Exposure depends on version, configuration, and deployment. Research describes application-dependent paths involving PHP-FPM; that does not establish immunity.
Does a PHP version string prove a vendor backport?
Not always. Vendor-maintained packages may include backports without a version string that clearly indicates the change. Confirm the fixed package with the vendor.
What remains uncertain?
Public announcements do not establish whether the Dutch services were successfully attacked or when each would return. Further incident, status, and backport information may clarify remaining exposure.
Why Runtime Patching Matters
The flaws affect the PHP runtime beneath a website, rather than a particular content-management system. Updating WordPress, Drupal or Joomla code and plugins does not by itself fix vulnerable PHP. The key operational question for a website owner is whether the runtime serving the site has been patched, including when hosting is managed by a third party.
PHP reported demonstrated exploitation on Apache with mod_php. The advisory for the out-of-memory flaw says code execution occurs as the web worker account, which does not by itself establish administrator or root access. Research by Wiz demonstrated unauthenticated code execution against deployments of WordPress, Drupal and Joomla, as well as a separate possibility of exposing sensitive process memory, including credentials or tokens. Those demonstrations concern the underlying PHP flaws, not separate vulnerabilities in each CMS.
The Dutch shutdown illustrates the consequences of uncertainty during a critical vulnerability response: services may become unavailable while operators assess exposure and wait for fixes. Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations indicate attempted exploitation, but do not establish that the named Dutch services were attacked successfully or breached.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdown and Patch Timeline
On October 21, the Dutch government said several websites were taken offline preventively because of the PHP vulnerabilities. Its announcement said there were no signs of active exploitation at the time and clarified that many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws. The shutdown was a precaution, not a public confirmation of a compromise.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance says systems that have not been patched should remain offline as a precaution. PHP-FPM can handle some startup failures differently from mod_php, but technical research cited in the source material describes application-dependent exploitation paths involving PHP-FPM; that distinction does not establish that PHP-FPM installations are immune.
The disclosure also involved security researchers and AI tools. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. Wiz described using AI tools in research, exploit development, detection and patch validation. Calif said its initial discovery used generally available models and was guided by a researcher with knowledge of PHP’s vulnerability history. PHP maintainers led the fixes and release.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement, as reported by ThorstenMeyerAI.com
As an affiliate, we earn on qualifying purchases.
Exposure and Service Status
The available announcements do not establish whether any of the Dutch services taken offline were successfully attacked, or when each would return to service. The government’s statement said there were no signs of active exploitation at that time; Cloudflare separately reported attack attempts, but did not establish a breach of those named services.
Exposure varies by PHP version, configuration and hosting setup. The published demonstrations do not show that every PHP installation is exploitable in the same way, and the source material does not provide a complete accounting of vulnerable systems or confirmed compromises. Organizations using hosting providers may need confirmation from the provider that the runtime—not just the site application—has been updated.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restarts
Operators should apply the fixed PHP release for their branch, or obtain a patched package from their distribution or extended-support provider. They should then verify that the corrected runtime is actually serving each affected website. Where a system remains unpatched, the Dutch NCSC guidance says it should stay offline as a precaution.
Organizations should also check with managed hosting providers and assess runtime configurations rather than relying on CMS update status alone. Further public information on the return of the Dutch services, confirmed incidents, and vendor backports would clarify the scope of the disruption and the remaining exposure.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell is the collective name used for CVE-2026-109618 and CVE-2026-109619. PHP says both critical flaws can lead to remote code execution without authentication.
Were the Dutch government websites hacked?
The government took several websites offline as a precaution and said it had seen no signs of active exploitation at the time of its announcement. The shutdown itself is not evidence of a successful attack.
Which PHP versions include fixes?
PHP lists fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1. Users of vendor-maintained packages should confirm with that vendor which fixed release applies.
Will updating WordPress or a plugin fix PHP2Shell?
No. These flaws are in the PHP runtime. Application and plugin updates alone do not patch the software that executes the site; operators need to update the runtime or confirm their hosting provider has done so.
Does the reporting confirm that all PHP-FPM sites are vulnerable?
No. Exposure depends on configuration and application behavior. Some failure handling differs between PHP-FPM and mod_php, but cited technical research describes possible application-dependent paths involving PHP-FPM, so that distinction is not proof of immunity.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
