🔍 Read the full analysis: PHP2Shell And PHP Security: Understanding The Dutch Government Website Outage on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released emergency fixes on 21 October 2026 for two critical vulnerabilities that can allow unauthenticated attackers to execute code remotely, and the Dutch government took several public-service websites offline as a precaution. The government said it had no signs of active exploitation of those services at the time of its announcement, so the shutdowns do not establish that they were compromised.

The flaws, collectively referred to in the source material as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated Critical. They affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisories describe memory-management failures that can lead to memory corruption or use-after-free conditions and, in some circumstances, remote code execution.

The Dutch government said Overheid.nl, MijnOverheid.nl and DigiD were among the sites taken offline on 21 October. It described the action as preventive, taken because of the vulnerabilities’ risk, and reported no signs of active exploitation at that point. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update. Its guidance says systems that have not been updated should remain offline as a precaution.

PHP lists fixed releases for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although the source reports minimal backports for versions 7.4, 8.0 and 8.1. Organizations relying on distribution or extended-support packages need to check their supplier for a fixed build; a version number by itself may not show whether a backport has been applied.

Why PHP Runtime Patching Matters

The flaws affect the PHP runtime beneath a website, not simply the content-management system or its plugins. Updating WordPress, Drupal or Joomla does not by itself patch the PHP software processing requests. Operators need to establish which runtime serves each site and whether that runtime has received the relevant vendor fix.

Researchers cited in the source material demonstrated unauthenticated code execution on some deployments of WordPress, Drupal and Joomla. Those demonstrations concern vulnerable PHP environments, not separate flaws in each content-management system. The source also reports demonstrations of sensitive process-memory disclosure, which could expose credentials or tokens even without code execution.

The practical consequences reach beyond government services. Websites and services may be taken offline while operators check exposure or apply fixes, and unpatched systems could face a risk of unauthorized access. Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. That is evidence of attempted exploitation activity as reported by the provider, not proof that the named Dutch sites were breached.

Dutch Shutdowns and PHP Fixes

The Dutch government’s announcement distinguished between precautionary shutdowns and confirmed compromise: it said there were no signs of active exploitation at the time. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws. The service outages therefore were not a blanket shutdown of all Dutch government websites.

The advisories describe two different failure paths. For CVE-2026-109618, an out-of-memory failure can interrupt an operation before internal request data is fully initialized, after which cleanup may handle invalid data incorrectly. For CVE-2026-109619, internal state can retain references to request memory that has already been freed. Both can lead to serious security consequences, though exposure depends on deployment and configuration.

PHP’s advisories report demonstrated exploitation on Apache with mod_php. The source material says PHP-FPM handles some startup failures differently, but Calif’s technical research describes application-dependent exploitation paths involving PHP-FPM; that distinction does not establish that PHP-FPM is immune. The PHP maintainers issued the fixes, with security researchers and infrastructure providers also involved in discovery, reporting and analysis.

“Updating website code or plugins alone does not resolve these vulnerabilities; the PHP software running the application must be patched.”

— Cloudflare

What Is Known About Exposure

The available statements do not establish whether attackers successfully exploited either vulnerability against the named Dutch services. The government reported no signs of active exploitation when it announced the shutdowns; Cloudflare’s separate report of attack traffic does not identify those services as targets or confirm a breach. The two accounts concern different observations and should not be conflated.

It is also not clear from the source material exactly when each Dutch service was taken offline, when it was restored, or whether every affected service had returned to normal operation. Individual exposure depends on the PHP version, vendor packaging, runtime, configuration and application behavior. Operators using managed hosting may not control the runtime directly, so they need confirmation from their provider that the serving environment is patched.

The reported AI-assisted research is another area where claims should be kept specific. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently reported discovering both vulnerabilities. Calif’s account says its researcher used generally available models and guided the investigation with knowledge of PHP’s vulnerability history. These are attributed research accounts; they do not change the confirmed patch guidance or establish that AI alone found or validated the flaws.

Patch Checks and Service Restoration

Organizations should identify every web-facing PHP environment, apply the fixed release or their supplier’s backported package, and verify that the patched runtime is actually serving the site. That includes checking hosted services with providers rather than assuming that an updated website application means its PHP engine is fixed. The NCSC guidance calls for systems that remain unpatched to stay offline as a precaution.

The Dutch government and affected service operators will need to confirm when services are back online and whether any further assessment changes the initial account of the incident. The supplied material does not give a restoration schedule or report a confirmed breach. Security teams will also need to review vendor notices and update status, since package version numbering can differ when distributors backport fixes.

Key Questions

Were Dutch government websites confirmed to have been hacked?

No confirmed compromise is reported in the supplied material. The Dutch government said it took several services offline as a precaution and reported no signs of active exploitation at the time of its statement.

Which PHP releases contain the fixes?

PHP listed fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of older or vendor-maintained branches should check with their distributor or support provider for a patched package or backport.

Does updating WordPress or its plugins fix PHP2Shell?

No. The flaws are in the PHP runtime. Updating a site or its plugins alone does not patch the PHP software processing its requests.

Are PHP-FPM deployments safe from the vulnerabilities?

The source material does not support treating PHP-FPM as immune. While some startup failures are handled differently than with mod_php, Calif describes application-dependent exploitation paths involving PHP-FPM. Operators should check their specific deployment and apply the relevant vendor fix.

What should website operators do now?

Identify the PHP runtime serving each website, apply the fixed upstream or vendor package, and verify the patched runtime is active. If a system is not yet updated, the Dutch NCSC guidance says it should remain offline as a precaution.

Source: ThorstenMeyerAI.com