🔍 Read the full analysis: PHP2Shell Exposes PHP Weaknesses Amid Dutch Government Website Downtime on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released security updates on October 21, 2026, for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. Dutch authorities took several public websites offline as a precaution; the government said it had no signs those services were actively exploited at the time of its statement.
PHP released emergency security updates on October 21 for two critical flaws that can allow unauthenticated remote code execution, while the Dutch government temporarily took several public websites offline as a precaution. The affected services included Overheid.nl, MijnOverheid.nl and DigiD; the government said its decision was preventive and reported no signs of active exploitation at the time of its announcement.
The vulnerabilities, collectively called PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, classified as Critical. The flaws involve PHP’s handling of memory and internal state when request processing is interrupted. One can cause cleanup to use request data that was not fully initialized after an out-of-memory failure; the other can leave references to memory that has already been freed. Both conditions can lead to remote code execution.
PHP said installations that process web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers demonstrated exploitation on Apache with mod_php. The PHP advisory says execution in the described out-of-memory scenario occurs as the web worker account, which does not automatically mean administrator or root access. Research also describes application-dependent exploitation paths involving PHP-FPM, so different configurations require separate assessment.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although PHP provided minimal source backports for 7.4, 8.0 and 8.1 because of the severity. Organizations using vendor-maintained or extended-support packages should check with their supplier for a fixed build; a version number alone may not show whether a backport has been applied.
Security Briefing · October 21, 2026
PHP2Shell Exposes PHP Weaknesses Amid Dutch Government Website Downtime
Emergency PHP fixes address two critical flaws that may enable unauthenticated remote code execution. Dutch authorities temporarily took several public websites offline as a precaution; their statement reported no signs of active exploitation at that time.
Both can lead to remote code execution
Critical rating for each CVE
PHP 8.2 through 8.5 maintenance branches
No signs of active exploitation reported then
What PHP2Shell Means
The name refers to two vulnerabilities in PHP request processing. Their failure modes differ, but both can create a path to code execution.
Incomplete request state
After an out-of-memory failure, cleanup may use request data that was not fully initialized. Researchers demonstrated exploitation on Apache with mod_php.
CVE-2026-109618References after free
The other flaw can leave references to memory that has already been freed, creating an unsafe condition during request handling.
CVE-2026-109619Unauthenticated RCE
Both advisories describe a possible route to remote code execution without authentication. This does not mean every PHP site is compromised.
CVSS v4.0 · 9.2 EACHWhy Runtime Patching Matters
PHP is the vulnerable layer. Updating a website’s content or extensions does not patch the runtime processing its requests.
Confirm the PHP runtime serving every site. Include web-facing installations managed by an external hosting provider, and verify that fixes are active on the actual request path.
PHP says installations that process web requests may be affected. The described out-of-memory scenario runs as the web worker account; that does not automatically grant administrator or root access.
Request processing stacks to assess
Research also describes application-dependent paths involving PHP-FPM. Exposure depends on version, hosting stack and configuration; assess each environment separately.
Wiz reported demonstrations involving WordPress, Drupal and Joomla deployments, plus potential sensitive process memory disclosure. These examples do not establish compromise of every deployment.
A PHP runtime flaw is not fixed by updating WordPress code or plugins alone. The underlying PHP installation needs a fixed release or vendor backport.
Dutch Shutdowns & Exposure
Officials reduced exposure while patches became available. Shutdowns and observed attack attempts are not proof that the named services were breached.
Temporary downtime
Overheid.nl, MijnOverheid.nl and DigiD were among the sites taken offline on October 21. Rijksoverheid.nl was cited among government sites that did not use PHP.
Patch or remain offline
The Dutch NCSC said patches were available and advised systems that had not been updated to stay offline as a precaution.
Attempts observed
Cloudflare reported attack traffic and attempts to alter payloads to bypass protections. This does not show that Dutch services were compromised.
What is established: PHP released fixes, Dutch authorities temporarily took several sites offline, and attack attempts were reported. The cited material does not confirm a breach of the named government services, provide a total count of vulnerable installations, or establish how many organizations were affected.
Patch Verification & Restoration
Use a short verification chain to move from exposure discovery to a safe service decision.
Find every runtime
List web-facing PHP installations, versions, request handlers and hosting providers.
Apply a fixed build
Install a PHP release or an approved vendor backport for each affected environment.
Check the live path
Confirm the patched runtime is the one actually serving requests; ask managed hosts for confirmation.
Decide on exposure
Keep unpatched systems offline as advised; restore services after patching and operational checks.
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 — PHP 8.1 and earlier are outside normal upstream support. PHP provided minimal source backports for 7.4, 8.0 and 8.1 because of the severity. Vendor-maintained packages may backport fixes without changing the version string, so confirm with the supplier.
Key Questions
Keep the reported facts separate from what remains unknown.
What is PHP2Shell?
A name for CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities whose advisories say they can lead to unauthenticated remote code execution.
Were Dutch sites confirmed hacked?
No breach is confirmed in the cited material. The government described the shutdowns as precautionary and reported no signs of active exploitation at the time of its statement.
Does updating WordPress fix it?
No. The issue is in the PHP runtime. Apply a fixed PHP release or vendor backport and verify the runtime serving the site is patched.
Why Runtime Patching Matters
PHP2Shell affects the runtime beneath a website, not just the site’s content management system or plugins. Cloudflare cautioned that updating WordPress code or extensions alone does not fix a vulnerable PHP installation. Website operators need to confirm that the PHP runtime actually serving each site has been patched, including when hosting is managed by an external provider.
The potential consequences extend beyond code execution. Wiz reported demonstrations of unauthenticated remote code execution against WordPress, Drupal and Joomla deployments, as well as disclosure of sensitive process memory that could expose credentials or tokens without achieving code execution. Those demonstrations illustrate possible effects of the PHP flaws; they do not mean every deployment of those platforms is compromised.
For public-service users, the shutdowns meant that some Dutch government services were temporarily unavailable while officials reduced exposure. For operators, the incident highlights the need to identify runtime versions, confirm vendor patches and decide whether exposed systems should remain offline until fixed. The available information does not establish that the named Dutch sites suffered a breach.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and PHP Exposure
The Dutch government said on October 21 that several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution. Its announcement said there were no signs of active exploitation at that time. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular vulnerabilities.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations concern attempted exploitation generally and do not show that the Dutch services were compromised.
The disclosure involved several research and response groups. PHP maintainers issued the fixes, while Wiz reported independently discovering both flaws. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative. Calif’s account says the initial discovery used generally available models and involved a researcher directing the investigation with knowledge of PHP’s vulnerability history. These accounts describe research contributions, not a change in responsibility for PHP’s releases.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Breach Status and Exposure Scope
The available government statement reported no signs of active exploitation when it was issued, but it did not establish that the services had been independently cleared of every form of compromise. The precautionary shutdown is not evidence that an attack succeeded. Cloudflare’s reported attack traffic likewise does not identify a successful breach of the named Dutch sites.
The total number of vulnerable installations, the number already patched and the number of organizations that may have been affected were not provided in the source material. Exposure also depends on the PHP version, hosting stack and configuration. Operators using distribution packages or managed hosting need confirmation from their vendor rather than relying on a dashboard or a version string alone.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations should identify every web-facing PHP installation, apply the fixed release or an approved vendor backport, and verify that the patched runtime is the one serving requests. Where a system remains unpatched, the Dutch NCSC guidance says it should stay offline as a precaution. Managed-hosting customers should ask providers to confirm the affected sites and completion of runtime patching.
The Dutch authorities had not provided, in the cited material, a timeline for restoring each service or a later account of any investigation. Further updates from the government, the NCSC, PHP maintainers and hosting providers may clarify restoration status and whether any compromise was found. Until then, the confirmed facts are the release of fixes, the temporary shutdowns and the reported attempts to exploit the flaws—not a confirmed breach of the named government services.
web server security hardening tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP’s advisories say both can lead to unauthenticated remote code execution.
Were Dutch government websites confirmed to be hacked?
No. The Dutch government said the shutdowns were precautionary and reported no signs of active exploitation at the time of its statement. The cited material does not confirm a breach of Overheid.nl, MijnOverheid.nl or DigiD.
Does updating WordPress fix PHP2Shell?
No. The issue is in the PHP runtime, so updating WordPress, Drupal, Joomla or their plugins alone does not patch it. Operators need to update the PHP software serving the site or obtain a fixed vendor package.
Which PHP releases contain the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1; users of vendor packages should verify the fix with their supplier.
What should website operators do now?
Check the PHP runtime and hosting configuration for each web-facing site, apply the relevant fixed release or vendor backport, and verify the patch is active. The Dutch NCSC advised keeping systems offline as a precaution if they have not been updated.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
