🔍 Read the full analysis: Critical PHP Flaws, PHP2Shell, And The Dutch Government Websites Going Offline on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency fixes on 21 October 2026 for two critical vulnerabilities that can enable remote code execution without authentication. The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs those services had been actively exploited. Operators need to patch the PHP runtime itself, not just their website applications.
PHP released emergency security updates on 21 October for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The Dutch government took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time.
PHP’s security advisories describe flaws in how the runtime handles memory and internal state when request processing is interrupted. One vulnerability involves an out-of-memory failure that can leave request data incompletely initialized before cleanup. The other involves internal state retaining references to memory that has already been freed. The resulting conditions can lead to memory corruption or use-after-free behavior and, in vulnerable deployments, remote code execution. Both advisories assign the flaws a CVSS v4.0 score of 9.2.
PHP’s security team identifies installations handling web requests as potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP published fixed releases for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided limited source backports for versions 7.4, 8.0 and 8.1. Organizations relying on distribution or extended-support packages should check with their supplier for a fixed package; version numbers alone may not show whether a vendor backport has been applied.
The Dutch government described its shutdowns as preventive action, not a response to confirmed compromise. The Dutch National Cyber Security Centre later said patches were available and urged organizations to update, advising that unpatched systems remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to modify payloads to bypass protections. Those observations show attempted exploitation, but do not establish that the Dutch sites were breached.
Security briefing · 21 October 2026
Critical PHP Flaws, PHP2Shell, and Dutch Government Websites Going Offline
PHP issued emergency fixes for two critical flaws that may enable unauthenticated remote code execution. The Dutch government took selected services offline as a precaution, reporting no signs of active exploitation of those services at the time.
What failed inside PHP
Both flaws involve how the runtime handles memory and internal state when request processing is interrupted. The effects depend on the deployment and configuration.
Incomplete request data
An out-of-memory failure can leave request data incompletely initialized before cleanup. The resulting memory corruption may enable code execution in vulnerable setups.
Stale memory reference
Internal state can retain references to memory that has already been freed, creating use-after-free behavior and a potential path to remote code execution.
Web worker access
PHP says demonstrated code execution runs as the web worker account. That can expose site data or credentials and create a foothold, depending on permissions.
At a glance: who needs to act?
PHP’s security team identifies installations handling web requests as potentially affected across several common deployment methods.
| Deployment | Potential exposure | Operator action |
|---|---|---|
| PHP-FPM | Potentially affected | Verify the package and runtime serving each site |
| Apache with mod_php | Demonstrated exploitation reported | Upgrade promptly and confirm workers use the fixed build |
| php-cgi | Potentially affected | Check the deployed PHP branch and vendor package |
| FrankenPHP and LiteSpeed | Potentially affected | Follow the runtime or hosting supplier’s fixed release guidance |
| Managed hosting | Depends on provider | Ask whether the PHP engine was updated across affected sites |
PHP-FPM may handle some startup failures differently from Apache with mod_php, but that does not prove immunity. Researchers have described application-dependent exploitation paths involving PHP-FPM.
How the response unfolded
The shutdown was a targeted precaution. Separate reports of attack attempts do not establish that the named Dutch services were breached.
Flaws disclosed
Two critical PHP runtime vulnerabilities were identified and assigned CVE numbers.
Services taken offline
The Dutch government shut selected websites as a precaution and reported no signs of active exploitation at that time.
Fixes published
PHP released emergency security updates on 21 October; the NCSC urged organizations to patch.
Verify, then restore
Operators should confirm remediation. The supplied sources give no restoration timetable.
Fixed releases & patch checks
Use the fixed release for your supported branch, or confirm with your distribution or extended-support supplier that its package includes the security backport.
Update the runtime
Prove the fix is live
PHP provided limited source backports for versions 7.4, 8.0 and 8.1. For vendor or extended-support builds, version numbers alone may not reveal whether a backport is present.
Confirm which PHP runtime handles live requests, check every affected site and service, and ask hosting providers specifically about the PHP engine. Keep unpatched affected systems offline as a precaution, following NCSC guidance.
Exposure is not the same as a confirmed breach
Reports describe attempted exploitation and demonstrations under specific conditions. They do not establish compromise of the named Dutch sites.
“There were no signs of active exploitation at the time of its announcement.”Dutch government
“The demonstrated code execution runs as the web worker account.”PHP security advisory · CVE-2026-109618
“Updating website code or plugins alone does not resolve the vulnerabilities.”Cloudflare guidance
Key questions
What the available reporting supports—and what it leaves unresolved.
Were the Dutch websites confirmed hacked?
No confirmed breach was reported in the government’s announcement. It said the selected sites were taken offline as a precaution, with no signs of active exploitation at that time.
Does updating a CMS fix the issue?
No. The PHP runtime must be patched. Updating application code, a CMS or its plugins does not repair the underlying PHP installation.
Are all Dutch government websites affected?
No. The government said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
Are the services back online?
The supplied source material does not establish whether the named services later returned online or provide a restoration timetable or later forensic assessment.
Why PHP Runtime Patching Matters
These flaws affect the PHP runtime beneath a website, rather than a particular content-management system or plugin. Updating WordPress, Drupal or Joomla code alone does not repair an affected PHP installation. Operators must establish that the runtime processing requests has received the fix and that the patched version is actually serving each site.
The potential impact extends beyond website availability. PHP reports demonstrated exploitation on Apache with mod_php, and researchers described remote code execution or sensitive process-memory disclosure in test deployments. PHP’s advisory says code execution in the demonstrated out-of-memory scenario runs as the web worker account; that does not by itself imply administrator or root access. The risk is still serious because a compromised web process may expose site data or credentials and could provide a foothold for further activity, depending on the system’s configuration and permissions.
For government services, taking sites offline trades availability for a reduced exposure window while operators assess and patch systems. For businesses using managed hosting, the relevant question is whether the provider has updated the PHP runtime serving their websites. A clean application dashboard does not answer that question.
As an affiliate, we earn on qualifying purchases.
How the Shutdowns and Fixes Unfolded
The Dutch government’s 21 October announcement said several services were being taken offline because of the PHP vulnerabilities. It said there were no signs of active exploitation at the time, and noted that many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws. The distinction matters: the shutdown was a precaution involving selected services, not evidence that all Dutch government websites were vulnerable or compromised.
PHP released fixes the same day, and the Dutch NCSC subsequently urged organizations to install them. Researchers also reported demonstrations on different configurations. Wiz said it demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments, as well as disclosure of sensitive process memory. Those are examples of impact from the underlying PHP flaws, not separate vulnerabilities in each content-management system.
Accounts of the research also describe AI tools being used in vulnerability discovery and analysis. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz reported independently discovering and disclosing both vulnerabilities. PHP maintainers handled the fixes and releases. Calif’s account says its initial discovery used generally available models and involved a researcher directing the investigation using knowledge of PHP’s vulnerability history; the reported results should not be read as evidence that an AI system independently found or fixed the flaws.
“There were no signs of active exploitation at the time of its announcement.”
— The Dutch government
As an affiliate, we earn on qualifying purchases.
Exposure and Breach Status
The Dutch government’s announcement reported no signs of active exploitation of the named services at that time, but the available source material does not establish whether those websites have since returned online or provide a later forensic assessment. Cloudflare’s reports of attack traffic and payload changes concern observed attempts; they do not confirm a successful breach of Overheid.nl, MijnOverheid.nl or DigiD.
Actual exposure depends on the PHP branch, deployment method, configuration and whether a vendor has supplied a backport. PHP-FPM may handle some startup failures differently from Apache with mod_php, but researchers have described application-dependent exploitation paths involving PHP-FPM; that difference is not proof of immunity. The source material does not provide a complete list of affected Dutch systems or establish how many organizations remain unpatched.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Operators should apply the fixed PHP release or an appropriate vendor package, then verify that the runtime handling live requests is the patched one. Organizations using hosting providers should ask specifically whether the PHP engine has been updated across the affected sites and services. Where patching is not yet complete, the NCSC’s published guidance is to keep affected systems offline as a precaution.
The next public milestones are confirmation of remediation and any announcements about the return of Dutch services. Operators and users should rely on updates from the government, the NCSC, PHP maintainers and their hosting providers for current status. The supplied source material does not give a timetable for restoration or report a confirmed compromise of the named Dutch websites.
remote code execution prevention tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to have been hacked?
No confirmed breach was reported in the government’s announcement. It said the sites were taken offline as a precaution and that there were no signs of active exploitation at that time. Separate reports of attack attempts do not establish that these services were compromised.
Which PHP versions contain the fixes?
PHP listed fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Limited source backports were also provided for 7.4, 8.0 and 8.1. Users of distribution or extended-support packages should verify the fixed version with their vendor.
Will updating WordPress or a plugin fix PHP2Shell?
No. The flaws affect the PHP runtime, which runs the application. Updating a website’s code or plugins does not by itself patch PHP; operators need to verify the runtime or ask their hosting provider to confirm the update.
Does PHP-FPM avoid the vulnerabilities?
The source material does not establish that PHP-FPM is immune. Some failure handling differs from Apache with mod_php, but researchers describe application-dependent exploitation paths involving PHP-FPM. Exposure depends on the deployment and its configuration.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
