🔍 Read the full analysis: Understanding PHP2Shell Amid Critical PHP Flaws And Dutch Site Downtime on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency updates on 21 October 2026 for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can enable unauthenticated remote code execution. Dutch government services including Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution; the government said it had no signs those services were being actively exploited at the time.
PHP released emergency security updates on 21 October 2026 for two critical flaws known collectively as PHP2Shell, which can allow unauthenticated attackers to execute code remotely. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time, not that they had been compromised.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated Critical. Both involve failures in how PHP manages memory or internal request state. One flaw can leave data incompletely initialized after an out-of-memory failure; the other can leave references to memory that has already been freed. Under certain conditions, those errors can lead to memory corruption or use-after-free behavior and then remote code execution.
PHP identifies web-facing installations as potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisories report demonstrated exploitation on Apache with mod_php. Researchers have also described application-dependent paths involving PHP-FPM, so deployment details matter; the different handling of some startup failures does not establish that PHP-FPM is immune. The reported code execution runs as the web worker account, which does not by itself imply administrator or root access.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using distribution packages or extended-support services should check with their vendor for a fixed package. A version number alone may not show whether a vendor has backported the fix.
Why PHP Runtime Patching Matters
PHP sits beneath many websites and content-management systems, so these flaws affect the runtime serving an application, not just the application’s own code. Updating WordPress, Drupal or Joomla, or installing a plugin update, does not patch the PHP engine. Operators need to establish whether the runtime handling each site’s requests has been updated and is actually serving the patched version.
That distinction also matters for users and public services. Taking a site offline can reduce exposure while an operator verifies its environment, but it is not evidence that an attacker got in. Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations indicate attempted exploitation, but do not establish that the named Dutch government services were compromised. PHP’s advisories also say a successful exploit can run code with the web worker’s permissions, a serious risk even though it does not automatically grant full system control.
The disclosure also illustrates the reported use of AI tools in security research. OpenAI said Calif identified a critical flaw with GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently reported discovering both vulnerabilities. The researchers describe AI assistance in finding flaws and developing or validating exploits; PHP maintainers led the fixes. Calif’s account says the initial discovery used generally available models and was guided by a researcher familiar with PHP’s vulnerability history. Those accounts describe research contributions, not a claim that AI independently found or fixed the flaws.
As an affiliate, we earn on qualifying purchases.
From Disclosure to Service Shutdowns
On 21 October, the Dutch government announced that several public websites, including Overheid.nl, MijnOverheid.nl and DigiD, were being taken offline as a precaution while the PHP vulnerabilities were addressed. The announcement said there were no signs of active exploitation at the time. It also said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that had not been patched should remain offline as a precaution. This sequence matters: the initial shutdown was a preventive measure made before patches were available, while the subsequent guidance addressed systems still unpatched. Neither statement, on its own, confirms an intrusion.
Separate research from Wiz demonstrated unauthenticated code execution against deployments of WordPress, Drupal and Joomla, as well as possible disclosure of sensitive process memory, including credentials or tokens. These demonstrations concern vulnerabilities in the PHP engine and do not mean the CMS products themselves contain the same flaws. PHP’s maintainers issued the fixes with support from researchers and infrastructure providers.
“The sites were taken offline as a precaution; the announcement said there were no signs of active exploitation at that time.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
Exposure and Exploitation Still Need Checking
It is not clear from the available announcements whether any Dutch service was compromised, or exactly when each affected service will return. The government reported no signs of active exploitation when it issued its statement, while Cloudflare separately observed attack attempts. Those reports concern different evidence and do not establish an intrusion into the Dutch sites.
The exposure of individual organizations also depends on their PHP branch, build, configuration, hosting provider and application. A site owner may not control the runtime directly, and a package’s displayed version may not reveal a vendor backport. Operators should confirm the patched status with their host or software supplier rather than infer it from application updates alone.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations should identify every internet-facing PHP deployment, apply the relevant fixed PHP release or vendor-provided backport, and verify that the patched runtime is the one serving requests. Those using managed hosting should ask providers for confirmation covering each affected site and environment. Unpatched systems should follow the NCSC’s advice to remain offline until their status is addressed.
Dutch agencies will need to confirm when affected services can safely return. The source material does not give a restoration timetable. Security teams should also review logs and available monitoring for signs of attempted or successful exploitation, while keeping those findings separate from the fact that a service was temporarily taken offline.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they can allow unauthenticated remote code execution.
Were the Dutch government websites hacked?
The government said it took several sites offline as a precaution and reported no signs of active exploitation at the time of its announcement. That does not confirm a compromise; the available material does not establish that any of the named services were breached.
Does updating WordPress fix PHP2Shell?
No. These flaws affect the PHP runtime, not just website code or plugins. The runtime serving the site must be patched, either by the operator or its hosting provider.
Which PHP releases contain fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided source backports for 7.4, 8.0 and 8.1. Users of distribution or extended-support builds should check for their vendor’s fixed package.
Can PHP-FPM deployments be affected?
PHP identifies PHP-FPM among potentially affected web-facing configurations. Some failure paths differ from Apache with mod_php, but researchers have described application-dependent PHP-FPM exploitation paths; that difference does not establish immunity.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
