🔍 Read the full analysis: PHP2Shell Explained: Critical PHP Flaws And Dutch Government Websites on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency patches on 21 October 2026 for two critical flaws that can allow unauthenticated remote code execution. Dutch authorities temporarily took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; their announcement reported no signs those services had been exploited.
PHP released emergency security updates on 21 October for two critical vulnerabilities, collectively called PHP2Shell, that can allow unauthenticated attackers to execute code remotely. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both received a CVSS v4.0 score of 9.2, rated Critical. PHP’s security advisories describe failures in handling internal memory and request state: one vulnerability can leave data incompletely initialized after an out-of-memory condition, while the other can leave stale references after request memory is freed. The resulting memory corruption or use-after-free conditions can lead to remote code execution.
PHP says web-request installations may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, but organizations relying on distribution or extended-support packages should check with their supplier for a fixed build. A version number by itself may not show whether a vendor has backported the fix.
The Dutch government’s shutdown was described as preventive action, not a response to confirmed compromise. The National Cyber Security Centre later said patches were available and advised organizations to update; its guidance says systems that have not been patched should remain offline as a precaution. The government also said many sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws.
Security briefing · PHP runtime · 21 October 2026
PHP2Shell Explained: Critical PHP Flaws and Dutch Government Websites
Two critical PHP vulnerabilities can enable unauthenticated remote code execution. Dutch authorities temporarily took several services offline as a precaution; their announcement reported no signs of active exploitation on those services at that time.
Why the PHP runtime matters
Exposure depends on the PHP installation serving requests, its configuration, and the host’s patch status.
Unauthenticated access
The flaws can allow an attacker to execute code remotely without first signing in. PHP advisories report demonstrated exploitation with Apache mod_php.
Multiple serving modes
Potentially affected web-request installations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Worker account execution
PHP says demonstrated execution runs as the web worker account. That does not automatically grant administrator or root access.
Two flaws, one urgent patch window
Both vulnerabilities concern internal memory and request state when PHP processing is interrupted.
Incomplete initialization
An out-of-memory condition can interrupt an operation before request data is fully initialized. Cleanup may then process invalid data, causing memory corruption.
Stale references
Internal state can retain references after request memory has been freed, creating use-after-free behavior that may lead to remote code execution.
From interrupted request to risk
Memory handling failures can compromise the process that serves a website request.
Request arrives
A web request reaches a PHP runtime.
Processing fails
Memory pressure or request cleanup disrupts internal state.
Memory is corrupted
Invalid data or freed references may be handled incorrectly.
Code may execute
An attacker may gain remote code execution as the web worker.
Fixed releases and backports
PHP published emergency security updates on 21 October 2026.
Minimal source backports were also supplied for PHP 7.4, 8.0, and 8.1. For distribution or extended-support packages, confirm with the supplier that the specific build includes the fix. A displayed version number alone may not reveal a vendor backport.
Dutch services: precaution, not confirmed compromise
The government described the shutdown as preventive action. The available announcements do not establish successful exploitation on the named services.
What officials reported
Overheid.nl, MijnOverheid.nl, and DigiD were taken offline temporarily. The Dutch government said it saw no signs that those services had been actively exploited at the time of its statement.
What remains unknown
The supplied sources do not specify the scope of successful exploitation elsewhere, the patch status of individual providers, or when each affected service would return.
What operators should do now
Identify the runtime behind each site and verify that patched software is serving requests.
Inventory runtimes
Find the PHP package and deployment mode for each public-facing site.
Apply the fix
Install a listed fixed release or a confirmed vendor-maintained update.
Verify serving version
Confirm the patched runtime is the one handling live requests.
Keep unpatched offline
Follow Dutch NCSC guidance to keep unpatched systems offline while remediation is pending.
Managed-hosting customers should ask their provider to confirm patching. Updating website code or plugins alone does not patch the PHP runtime.
Three details that shape the response
Reported evidence distinguishes technical exposure, attempted attacks, and confirmed compromise.
“The demonstrated execution runs as the web worker account.”
PHP security advisory“Updating website code or plugins alone does not resolve these vulnerabilities.”
Cloudflare guidance“Several websites were taken offline as a precaution.”
Dutch government announcementKey questions
Keep the main facts in view as patch and service updates arrive.
What is PHP2Shell?
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can lead to unauthenticated remote code execution.
Were the Dutch sites confirmed hacked?
No confirmed compromise was reported. Officials said the services were taken offline as a precaution and reported no signs of active exploitation at that time.
Which releases include fixes?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Backports were also supplied for 7.4, 8.0, and 8.1; verify vendor packages directly.
Why PHP Runtime Patching Matters
PHP runs on the server that processes website requests, so the exposure is not limited to a particular content-management system. Updating WordPress, Drupal or Joomla alone does not patch PHP; the software runtime and its configuration must be addressed. Cloudflare’s guidance makes the same distinction, while research from Wiz demonstrated unauthenticated code execution against deployments of all three platforms. Those demonstrations show the potential impact of the PHP flaws, not separate vulnerabilities in each CMS.
For organizations using managed hosting, the immediate question is whether the provider has patched the PHP runtime serving each site. PHP’s advisories report demonstrated exploitation on Apache with mod_php. One advisory says execution occurs as the web worker account, which does not automatically mean administrator or root access. Researchers also described application-dependent exploitation paths involving PHP-FPM; different handling of some startup failures does not establish that PHP-FPM is immune.
Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. That indicates attempted exploitation, but does not establish that the named Dutch websites were breached. The distinction matters for service users: temporary unavailability reflects officials’ precautionary response, while the available source material does not confirm an intrusion into those services.
As an affiliate, we earn on qualifying purchases.
The Flaws and the Patch Releases
The vulnerabilities concern PHP’s management of internal memory and request state when processing is interrupted. In the first flaw, an out-of-memory failure can interrupt an operation before request data is fully initialized; cleanup may then handle invalid data as if it were valid. The second involves internal state that remains after the memory it references has been freed. PHP’s advisories say these conditions can result in memory corruption or use-after-free behavior and potentially remote code execution.
PHP published fixes across supported branches on 21 October. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes. PHP 8.1 and earlier are outside normal upstream support, although minimal source backports were also supplied for 7.4, 8.0 and 8.1. Operators using vendor-maintained packages need to confirm whether their specific package includes the correction rather than relying only on its displayed version.
The disclosure also involved AI-assisted security research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz separately discovered and reported both vulnerabilities. PHP maintainers led the fixes and release. Calif’s account says the research used generally available models and that the researcher guided the investigation using knowledge of PHP’s vulnerability history; claims about AI’s role should be understood as accounts from the research participants.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
— Dutch government announcement
web server memory protection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Exposure and Compromise Status
The available announcements do not establish whether attackers successfully exploited the PHP2Shell flaws on any of the named Dutch services. The Dutch government said it had seen no signs of active exploitation at the time of its statement; Cloudflare’s later report of attack attempts does not identify those services as compromised. The scope of any successful exploitation elsewhere is not specified in the supplied material.
Exposure also depends on the PHP runtime, configuration, hosting arrangement and whether a vendor has applied a backport. The sources do not provide a complete list of affected organizations or confirm the patch status of individual hosting providers. Research findings about different PHP configurations indicate that operators should not treat one deployment mode as automatically safe.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restarts
Organizations should identify the PHP runtime and package serving each public-facing site, apply the relevant fixed release or vendor update, and verify that the patched software is actually handling requests. Managed-hosting customers should ask providers to confirm runtime patching; updating application code alone is not enough. Organizations following Dutch NCSC guidance should keep unpatched systems offline while remediation is pending.
The Dutch government’s announcement said the affected services were taken offline as a precaution. The supplied sources do not state when each service would return or provide a later confirmation of its patch status. The next updates to watch for are service restoration notices, vendor patch confirmations and any revised assessments of exploitation.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for CVE-2026-109618 and CVE-2026-109619, two PHP vulnerabilities that can lead to unauthenticated remote code execution.
Were the Dutch government websites confirmed to be hacked?
No confirmed compromise was reported in the Dutch government announcement. It said several services were taken offline as a precaution and that there were no signs of active exploitation at that time.
Which PHP versions include the fixes?
The listed patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Backports were also supplied for 7.4, 8.0 and 8.1; users of vendor packages should confirm directly that their package contains the fixes.
Does updating WordPress fix PHP2Shell?
No. The fixes need to be applied to the PHP runtime serving the site. Updating WordPress, its themes or its plugins does not by itself patch PHP.
Does a PHP-FPM setup avoid the vulnerabilities?
Not necessarily. The source material says PHP-FPM handles some startup failures differently, but describes application-dependent exploitation paths and does not establish immunity. Operators should apply the relevant fix and review their configuration.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
