🔍 Read the full analysis: How PHP2Shell Is Linked To Critical PHP Flaws And Offline Dutch Websites on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency fixes on Oct. 21 for two critical vulnerabilities that can enable unauthenticated remote code execution. Dutch authorities temporarily took several public websites, including DigiD, offline as a precaution; their announcement said there were no signs those services had been exploited.
PHP released emergency security updates on Oct. 21 for two critical flaws, collectively called PHP2Shell, that can allow unauthenticated remote code execution. The Dutch government said it had taken several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; its announcement said there were no signs of active exploitation of those services at the time.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and both have a CVSS v4.0 score of 9.2, rated Critical, according to PHP’s advisories. They affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The flaws involve mishandled memory or internal state when request processing is interrupted, and can lead to remote code execution.
PHP published fixes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, though PHP provided minimal source backports for versions 7.4, 8.0 and 8.1. Administrators using distribution packages or extended support should check with their vendor for a fixed package: a version number by itself may not show whether a backport has been applied.
The Dutch National Cyber Security Centre said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. The government also said many other sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws.
Security briefing · October 21
PHP2Shell: Critical PHP Flaws, Dutch Sites Offline
Emergency PHP fixes address two critical flaws that can enable unauthenticated remote code execution. Dutch authorities temporarily took several public services offline as a precaution and said there were no signs those services had been exploited.
01 / What the flaws mean
A runtime problem with broad reach
PHP2Shell affects the PHP runtime that handles web requests. Updating a site’s content-management system or extensions alone does not patch the software beneath it.
The issue
Interrupted request handling
Mishandled memory or internal state during interrupted request processing can create paths to remote code execution. Sensitive process memory may also be disclosed, potentially exposing credentials or tokens.
Affected environments
Multiple PHP handlers
Installations handling web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Exposure depends on version, configuration and hosting setup.
Demonstrated impact
Application examples
Researchers demonstrated code execution against WordPress, Drupal and Joomla deployments. These examples show PHP runtime risk; they do not identify separate flaws in those content-management systems.
Two tracked vulnerabilities:
CVE-2026-109618 and CVE-2026-109619. PHP’s advisories assign each a CVSS v4.0 score of 9.2, rated Critical.
Privilege context:
PHP reports demonstrated exploitation on Apache with mod_php. Code execution as the web worker account does not by itself mean administrator or root access.
02 / Dutch response
Exposure managed before restoration
The shutdowns reduced exposure while operators assessed and patched systems, but temporarily interrupted access for residents and businesses.
Services named
Several public websites taken offline
The Dutch government named Overheid.nl, MijnOverheid.nl and DigiD among services temporarily taken offline as a preventive measure. It said there were no signs of active exploitation of those services at the time.
Scope note
Not every government site was affected
The government said many other sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws. The supplied information does not identify the PHP versions or configurations on the named sites.
Oct. 21
PHP publishes emergency security fixes for two critical flaws.
Precaution
Dutch authorities take several public services offline.
Patch guidance
The Dutch NCSC urges updates and says unpatched systems should remain offline.
Restore
Operators must verify fixes; no restoration timetable was included in the supplied material.
03 / Patch map
Fixed releases by PHP branch
Apply the fixed release for the branch in use, or obtain a vendor-maintained package with the backport.
Older branches and vendor packages: PHP 8.1 and earlier are outside normal upstream support. PHP provided minimal source backports for 7.4, 8.0 and 8.1. Check with your distribution or extended-support vendor: a version number alone may not show whether a backport has been applied.
04 / Evidence and uncertainty
Keep observations separate from outcomes
Reported attack activity signals attempts in the wider environment. It does not establish that a particular target was compromised.
Attempts reported by Cloudflare
Cloudflare said it observed attack traffic and attempts to modify payloads to bypass protections. That is evidence of attempted exploitation seen by the provider, not proof of a successful attack on Dutch government services.
Compromise remains unconfirmed
The supplied material does not confirm successful compromise at organizations outside the named Dutch services, identify their deployed PHP versions, or provide a restoration timetable.
05 / Operator checklist
Verify the runtime serving real traffic
A dashboard update is not enough. Confirm that the patched PHP runtime is the one actually handling requests for each site.
01 / Identify
Map every PHP deployment
Check the handler, branch, configuration and hosting arrangement behind each exposed website.
02 / Patch
Update or confirm a backport
Install the appropriate fixed release or request explicit confirmation from the package or hosting provider.
03 / Verify
Keep unconfirmed systems offline
Follow Dutch NCSC guidance: systems that remain unpatched should stay offline as a precaution.
06 / Key questions
What the headlines leave out
Were DigiD and the other sites hacked?
The government said they were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. The supplied information does not confirm a compromise.
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP runtime. Updating WordPress, another CMS or its plugins does not patch the PHP software running the site.
Does Cloudflare’s report prove a breach?
No. Reported attack traffic and payload changes show activity, but do not prove a successful compromise or establish that Dutch government sites were affected.
What should hosted-site owners ask?
Ask the provider to confirm that the affected runtime was patched and is the runtime actually serving your traffic. Check vendor guidance for managed packages and older branches.
Why PHP Runtime Patching Matters
PHP2Shell affects the runtime beneath a website, not just its content-management system or plugins. Cloudflare warned that updating WordPress code or extensions alone does not fix vulnerable PHP software. Website owners need to establish whether the runtime serving each site has been patched, including where hosting is managed by a third party.
Researchers demonstrated unauthenticated remote code execution against deployments of WordPress, Drupal and Joomla. Those demonstrations illustrate the potential impact of flaws in PHP itself; they do not mean each content-management system has a separate vulnerability. Wiz also demonstrated that sensitive process memory could be disclosed, potentially exposing credentials or tokens even without achieving code execution.
The Dutch shutdowns show how a serious software flaw can affect access to public services before any compromise is confirmed. Taking services offline reduces exposure while an organization assesses and patches its systems, but it can interrupt access for residents and businesses. Authorities’ preventive action should not be read as evidence that the named websites were breached.
As an affiliate, we earn on qualifying purchases.
How the Dutch Response Unfolded
The Dutch government announced on Oct. 21 that several services had been taken offline as a preventive measure. It said there were no signs of active exploitation at the time of its statement. The Dutch NCSC later confirmed that patches were available and advised organizations to update, while recommending that systems not yet patched remain offline.
Separately, Cloudflare reported observing attack traffic and attempts to modify payloads to bypass its protections. That is evidence of attempted exploitation seen by the provider, not proof that the Dutch services were compromised. PHP’s advisories report demonstrated exploitation on Apache with mod_php. One advisory says execution occurs as the web worker account, which does not by itself mean an attacker has administrator or root privileges.
Deployment details matter when assessing exposure. Some demonstrated attacks against mod_php can occur before application code runs. Research by Calif describes application-dependent exploitation paths involving PHP-FPM; differences in how PHP-FPM handles some startup failures do not establish that it is immune.
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
It is not clear from the cited announcements whether any organization outside the Dutch services experienced a successful compromise. Cloudflare’s reported attack traffic and attempts to alter payloads indicate activity, but do not establish that an attack succeeded. The Dutch government’s statement specifically described no signs of active exploitation of the named services at that time.
Exposure also depends on the PHP runtime, version, configuration and hosting arrangement. The supplied material does not identify which PHP versions or configurations were running on the Dutch websites, or when each service was restored. For hosted sites, customers may need confirmation from their provider that the affected runtime was patched and is the one actually serving their traffic.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations should apply the fixed PHP release appropriate to their branch, or obtain a vendor-maintained fixed package, then verify that the patched runtime is serving requests. Where that cannot yet be confirmed, the Dutch NCSC guidance calls for affected systems to remain offline. Site operators using managed hosting should request explicit confirmation of the runtime update rather than relying on a current application or plugin dashboard.
The Dutch government and affected service operators have not, in the supplied material, given a restoration timetable. The next updates to watch for are confirmation that services are back online, further guidance from the NCSC, and any revised information about exploitation or impact. Until then, the known facts remain distinct: critical PHP flaws were patched, Dutch websites were taken offline as a precaution, and the government said it had no signs those services had been actively exploited.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can lead to remote code execution when request processing encounters particular memory or internal-state failures.
Were DigiD and the other Dutch websites hacked?
The Dutch government said the sites were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. The supplied information does not confirm that those services were compromised.
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP runtime. Updating WordPress, another content-management system, or its plugins does not replace patching the PHP software that runs the site.
Which PHP releases contain the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations on older branches or vendor-managed packages should check for a fixed backport or upgrade guidance from their package provider.
Does Cloudflare’s reported attack traffic prove a breach?
No. Cloudflare reported observing attack traffic and attempts to change payloads, but that observation alone does not prove a successful compromise or establish that the Dutch government sites were affected.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
