🔍 Read the full analysis: PHP2Shell: Understanding Critical PHP Flaws And Dutch Website Outages on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency updates on 21 October 2026 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. Dutch authorities temporarily took several public-facing services offline as a precaution; the government said it had no signs those services were being actively exploited at the time of its announcement.
PHP released emergency security updates on 21 October for two critical vulnerabilities that can allow attackers to run code remotely without logging in, while the Dutch government took several services, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution. The government said it had no signs of active exploitation of those services when it made its announcement; the shutdowns were preventive, not confirmation of a breach.
The flaws, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories rate both Critical, with CVSS v4.0 scores of 9.2. They affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The vulnerabilities involve PHP’s handling of memory and internal request state when request processing is interrupted. The first flaw can leave data incompletely initialized after an out-of-memory failure, allowing cleanup to misuse it; the second can leave references to memory after it has been freed. PHP’s advisories say these conditions can lead to remote code execution. A demonstrated exploit on Apache with mod_php runs as the web worker account, which does not by itself imply administrator or root access.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1. Those branches are outside normal upstream support, so organizations using vendor-maintained or extended-support packages need to check with their provider for a fixed build. A version number alone may not show whether a vendor has applied a backport.
Security Briefing · 21 October 2026
PHP2Shell: Critical PHP Flaws, Dutch Website Outages
Two critical PHP vulnerabilities can enable unauthenticated remote code execution. Dutch authorities temporarily took several public services offline as a precaution. At announcement, the government said it had no signs those services were being actively exploited.
Precautionary shutdowns do not confirm a breach.
Public statements did not confirm compromise or data theft from the named services.Patch the PHP runtime serving each site.
Updating WordPress, themes, or plugins alone does not fix the underlying PHP flaws.01 / What the flaws do
One runtime, two memory failures
PHP’s advisories describe interrupted request processing that can leave memory or internal request state unsafe. Under affected conditions, cleanup may misuse incomplete data or refer to memory that has already been freed.
Incomplete initialization
An out-of-memory failure can leave data only partly initialized. Later cleanup may misuse that data, creating a path that can lead to remote code execution.
Use after free
Interrupted request handling can leave references to memory after it has been freed. PHP says this condition can also lead to remote code execution.
Code execution and exposure
Researchers demonstrated code execution and sensitive process-memory disclosure. Possible exposure of credentials or tokens is a risk described in research, not proof of theft.
Web request processing across PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments.
A demonstrated Apache with mod_php exploit ran as the web worker account. That does not by itself mean administrator or root access.
02 / Patch map
Match the fix to the runtime branch
Confirm the package actually running in production has the fix. Older or vendor-maintained branches may receive backports whose status is not obvious from the upstream version string.
| PHP branch | Fixed release / guidance | Operator check |
|---|---|---|
| 8.5 | 8.5.12 | Deploy and verify in production |
| 8.4 | 8.4.27 | Deploy and verify in production |
| 8.3 | 8.3.36 | Deploy and verify in production |
| 8.2 | 8.2.35 | Deploy and verify in production |
| 7.4, 8.0, 8.1 | Minimal source backports supplied | Check vendor or extended-support provider for a fixed build |
Branches 7.4, 8.0, and 8.1 are outside normal upstream support. A version number alone may not show whether a vendor applied a backport. Ask the package provider or hosting service to confirm.
03 / Runtime reality
Application updates do not patch PHP
The PHP runtime sits beneath content management systems and other applications. The risk depends on the deployed runtime and configuration, so operators must check the environment serving each site.
Identify
Find the PHP runtime and version behind every public-facing site.
Confirm
Check the fixed release or vendor backport with your host or package provider.
Patch
Apply the appropriate fixed build and ensure the production service uses it.
Restore safely
If still unpatched, keep the system offline as a precaution, following Dutch NCSC guidance.
04 / The Dutch response
Preventive outages, carefully scoped
On 21 October, the Dutch government said several services were taken offline before patches were available. It reported no signs of active exploitation at that time.
“There were no signs of active exploitation at the time of the statement.”
Dutch government announcement · 21 October 2026The shutdowns were precautionary. The statement did not say every Dutch government website used PHP or was affected.
05 / Evidence and limits
Separate observed attempts from confirmed impact
Security research and provider reports describe real attack activity and demonstrations. Those reports do not establish a successful intrusion into the Dutch services named by the government.
Attack traffic observed
Cloudflare reported attack traffic and attempts to alter payloads to bypass protections. That is evidence of attempts, not confirmation of a successful attack on the named Dutch services.
Multiple application types
Wiz reported unauthenticated code execution demonstrations against WordPress, Drupal, and Joomla deployments. The flaws are in the shared PHP engine, not separate CMS vulnerabilities.
No named service breach
Available statements do not confirm compromise or theft of data or credentials from Overheid.nl, MijnOverheid.nl, or DigiD.
Timetable and coverage
The source material does not establish when each service would return, which versions all operators used, or how many systems had been patched.
06 / Operator checklist
Patch checks and service restoration
07 / Key questions
What operators and readers need to know
What is PHP2Shell?
A collective name for CVE-2026-109618 and CVE-2026-109619, two PHP flaws that can create conditions for unauthenticated remote code execution.
Were Dutch services hacked?
The government said it shut several services down as a precaution and reported no signs of active exploitation at announcement. The source material does not confirm a compromise.
Does updating WordPress fix this?
No. Update the PHP runtime serving the site. CMS, theme, and plugin updates do not patch these underlying PHP vulnerabilities.
Why Runtime Patching Matters
The affected software sits beneath applications such as content management systems. Updating a WordPress site, its themes or its plugins does not patch the PHP runtime that executes the site. Operators need to confirm that the actual PHP environment serving each website has been updated, including deployments managed by a hosting provider.
The risk also depends on deployment details. Researchers demonstrated exploitation on Apache with mod_php, including paths that can run before application code. PHP-FPM may handle some startup failures differently, but that is not proof of immunity: technical research cited in the source describes application-dependent exploitation paths involving PHP-FPM. Organizations therefore need to assess their runtime and configuration rather than assume a particular setup is safe.
PHP flaws can affect many different sites that share the same runtime, making provider-level remediation relevant to publishers, businesses and public services. Researchers also demonstrated sensitive process-memory disclosure that could expose credentials or tokens, even without achieving code execution. These are possible impacts described in research, not evidence that specific credentials were taken.
As an affiliate, we earn on qualifying purchases.
How Dutch Services Responded
The Dutch government’s 21 October statement said several services were taken offline as a precaution before patches were available. It reported no signs of active exploitation at that time. The same statement said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws. The shutdowns should not be read as evidence that all Dutch government sites were vulnerable or compromised.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its published guidance says systems that have not been updated should remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. That account indicates exploitation attempts were observed, but it does not establish a successful attack against the Dutch services named by the government.
Wiz reported demonstrations of unauthenticated code execution against WordPress, Drupal and Joomla deployments. These illustrate how flaws in the shared PHP engine can affect different applications; they are not separate vulnerabilities in each content management system. The discovery accounts also describe AI tools used in security research, but PHP’s maintainers led the fixes and release process.
“The government said there were no signs of active exploitation at the time of its statement.”
— Dutch government announcement
What Is Not Yet Confirmed
The available statements do not confirm that Overheid.nl, MijnOverheid.nl or DigiD were compromised, nor do they report theft of data or credentials from those services. The Dutch government said there were no signs of active exploitation when it announced the precautionary shutdowns. Cloudflare’s reported attack traffic is a separate observation and does not establish a successful intrusion into the named services.
It is also not clear from the source material when each Dutch service would return online, which PHP versions and configurations were present across all affected operators, or how many systems had been patched. Demonstrations against several web applications show potential impact, but do not establish that every deployment of those applications is vulnerable or exploitable in the same way.
For systems using vendor or extended-support packages, the fix status may depend on backports not reflected by the upstream version number. Operators need confirmation from their package provider or hosting service, rather than relying on an application dashboard or version label alone.
Patch Checks and Service Restoration
Organizations should apply the fixed PHP release appropriate to their branch, or obtain a patched package from their operating-system or hosting vendor. They should verify which runtime serves each site and confirm the fix is active in production. If a system remains unpatched, the Dutch NCSC guidance says it should stay offline as a precaution.
For businesses using managed hosting, the next step is to ask the provider whether the PHP runtime serving each affected website has been patched and when that change took effect. Site owners should separately check whether the provider has issued a backport for older supported environments. Updating application code alone does not address these flaws.
The Dutch government would need to provide further updates to clarify when the offline services would return and whether its assessment changes. PHP’s advisories and national cybersecurity guidance remain the reference points for fixes and operating precautions; the source material does not give a confirmed restoration timetable.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can create conditions that lead to unauthenticated remote code execution.
Were the Dutch government websites hacked?
The government said it took several services offline as a precaution and reported no signs of active exploitation at the time of its announcement. The source material does not confirm a successful compromise of the named services.
Does updating WordPress fix the vulnerabilities?
No. The flaws affect the PHP runtime, not WordPress alone. Updating WordPress, plugins or themes does not replace the need to patch the PHP software running the site.
Which PHP releases include the fixes?
The fixes were included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied source backports for versions 7.4, 8.0 and 8.1; operators using vendor packages should confirm the fixed build with their provider.
What should website operators do now?
Apply the fixed PHP release or vendor package, verify that the production runtime is patched, and contact the hosting provider if PHP is managed for them. The Dutch NCSC says systems that have not been updated should remain offline as a precaution.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
