🔍 Read the full analysis: PHP2Shell Exposes PHP Risks As Dutch Government Websites Experience Downtime on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released security updates on October 21 for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The Dutch government temporarily took several websites, including DigiD, offline as a precaution; it said it had no signs those services were actively exploited at the time of its announcement.
PHP released emergency security updates on October 21 for two critical vulnerabilities that can allow attackers to run code remotely without logging in, as the Dutch government temporarily took several websites offline as a precaution. The government named Overheid.nl, MijnOverheid.nl and DigiD, and said it had no signs of active exploitation at the time of its announcement; the shutdowns were not confirmation that those services had been breached.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell in the source report, affect PHP installations that handle web requests. The PHP security advisories list environments including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Both flaws carry a CVSS v4.0 score of 9.2, rated Critical in the cited advisories.
PHP says the issues arise from how the runtime manages memory and internal request state when processing is interrupted. One flaw involves cleanup after an out-of-memory failure involving incompletely initialized request data; the other involves references to internal state that remain after the memory they point to has been freed. The resulting memory corruption or use-after-free conditions can lead to remote code execution. Researchers also demonstrated disclosure of sensitive process memory, which could expose credentials or tokens without code execution.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided limited source backports for versions 7.4, 8.0 and 8.1, according to the source report. Organizations using operating-system distributions or extended-support packages should check their vendor’s security notice: a version number alone may not show whether a backported fix is installed. PHP 8.1 and earlier are outside normal upstream support.
Why Runtime Patching Matters
PHP runs on the server beneath content-management systems and websites, so the reported flaws are in the runtime, not in WordPress, Drupal or Joomla themselves. Updating a site’s plugins or application code does not repair a vulnerable PHP installation. Operators need to identify which runtime serves each site and verify that the fixed package is active.
The Dutch shutdowns show how a software flaw can affect access to public services before any compromise is confirmed. DigiD is used to access government services, so taking it offline can interrupt residents’ ability to complete online tasks. The government’s precaution reflects a risk decision, not proof that attackers accessed its systems. For organizations relying on managed hosting, the key question is whether the provider has patched the PHP runtime serving their sites.
The security consequences also depend on configuration and execution context. The source report says demonstrations on Apache with mod_php showed exploitation, including paths that can run before application code. The cited research describes different behavior in some PHP-FPM startup failures, while also outlining application-dependent exploitation paths. PHP’s advisory says execution occurs as the web worker account; that does not by itself mean an attacker obtains administrator or root privileges.
As an affiliate, we earn on qualifying purchases.
How the Flaws Reached Public Attention
The PHP advisories and fixes were published on October 21, 2026. The Dutch government said several services were taken offline preventively while patches were not yet available. It also said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update; its published guidance says systems that have not been patched should remain offline as a precaution.
Security providers reported observing attempted exploitation, but those reports do not establish that the named Dutch government services were compromised. Cloudflare said it saw attack traffic and attempts to alter payloads to evade its protections. Wiz reported demonstrations against deployments of several content-management systems. These are reports of observed or demonstrated activity, not evidence that every PHP site—or the Dutch services taken offline—was successfully attacked.
The source report also says researchers used AI tools during vulnerability research. OpenAI credited Calif with identifying a critical flaw through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers handled the fixes. Calif’s account says the discovery involved generally available models guided by a researcher familiar with PHP’s vulnerability history; these accounts describe research methods, not a claim that AI acted without human direction.
“It said there were no signs of active exploitation at the time of its announcement.”
— The Dutch government
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The cited government announcement reported no signs of active exploitation of the named Dutch services at the time, but the source material does not establish whether later investigations found attempted access or whether any systems were compromised. The reasons for each site’s exposure status and the timing of restoration were not specified.
It is also unclear how many PHP installations worldwide remained vulnerable when the fixes were published, or how quickly hosting companies and software distributors applied them. A vulnerable PHP version can be installed in different configurations, and vendor backports may not be apparent from the displayed version string. Reports of attack traffic and researcher demonstrations establish risk and attempted activity, not the extent of successful exploitation.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Operators should install the applicable PHP security update or a fixed package supplied by their operating-system or hosting vendor, then verify that the patched runtime is the one actually serving requests. Sites that remain unpatched should follow Dutch NCSC guidance to stay offline as a precaution. Website owners using managed hosting should ask providers for confirmation that the runtime—not just the application or plugins—has been updated.
The Dutch government’s next steps are to assess affected services and determine when they can safely return online; the source material provides no restoration schedule. Organizations should also monitor guidance from PHP, their hosting vendors and national cybersecurity authorities as information about exploitation and remediation develops.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
They are two PHP runtime flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s advisories describe memory-management and internal-state problems that can lead to remote code execution without authentication.
Were the Dutch government websites confirmed to be hacked?
No. The government took several websites offline as a precaution and said it had no signs of active exploitation at the time of its announcement. The shutdown itself does not confirm a breach.
Does updating WordPress or a website plugin fix the flaws?
No. The vulnerabilities are in the PHP runtime. Website owners need to confirm that the PHP software or vendor package serving the site has been patched; updating application code alone does not address the runtime flaw.
Which PHP releases contain fixes?
The source report lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases, plus limited source backports for PHP 7.4, 8.0 and 8.1. Users of distribution or extended-support packages should check their vendor’s advisory, since a backport may not change the apparent version in the usual way.
What should a website operator do if a host manages PHP?
Ask the provider whether the PHP runtime serving each affected site has been patched, and request confirmation of the fixed package or release. A current WordPress or other site dashboard does not show whether the underlying runtime is protected.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
