🔍 Read the full analysis: Dutch Government Sites Offline: What PHP2Shell Has To Do With PHP Flaws on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical vulnerabilities known as PHP2Shell. Officials said there were no signs of active exploitation at the time of their announcement; the shutdown was not confirmation that those sites had been breached. PHP released fixes, and the Dutch National Cyber Security Centre urged operators to patch affected runtimes.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation when it announced the shutdown; the measure was preventive and did not confirm that the named services had been compromised.
The vulnerabilities, called PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP installations that handle web requests. PHP’s security team lists configurations including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Both advisories carry a CVSS v4.0 score of 9.2, classified as Critical.
PHP released patched versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although PHP supplied minimal source backports for versions 7.4, 8.0 and 8.1. Organizations using distribution packages or extended support need to check their supplier for a fixed build; a version number by itself may not show whether a backport is included.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance says systems that remain unpatched should stay offline as a precaution. The government also said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
Cybersecurity briefing · 21 October
Dutch Government Sites Offline: What PHP2Shell Has To Do With PHP Flaws
TL;DR: The Netherlands took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution after PHP disclosed two critical vulnerabilities. Officials reported no signs of active exploitation when they announced the shutdown. It was preventive; it did not confirm those services had been breached.
A runtime issue, not a website plugin issue
PHP2Shell refers to two flaws in PHP request handling. In affected circumstances, they may enable unauthenticated remote code execution. The vulnerable layer is the PHP runtime serving requests.
Memory corruption
An out-of-memory failure can interrupt initialization. Cleanup may then treat invalid request data as valid, corrupting memory.
Use after free
Internal state can retain references to request memory after that memory has been released, creating an unsafe condition.
Remote code execution
Advisories and research describe RCE as a possible outcome. Exposure depends on the runtime, configuration and application path.
Follow the PHP runtime beneath each site
PHP lists request-serving setups including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. A CMS or plugin update alone does not patch PHP.
Patch status is about the serving runtime
The chart shows the checks operators need to make, not a measurement of affected systems.
Update the runtime
Confirm the fixed PHP release or a verified supplier backport is running on the production request path.
CMS updates alone
Updating WordPress, Drupal, Joomla, themes or plugins does not fix vulnerable PHP software underneath.
Match the fix to the actual deployment
PHP published patched versions on 21 October. Organizations using distribution packages or extended support should verify the supplier’s fixed build: backports may not be obvious from a version number.
PHP 8.5.12
Patched upstream release for the 8.5 line.
8.4.27 · 8.3.36
Patched upstream releases for the 8.4 and 8.3 lines.
PHP 8.2.35
Patched upstream release for the 8.2 line.
PHP 8.1 and earlier are outside normal upstream support. PHP supplied minimal source backports for 7.4, 8.0 and 8.1. Check with the package supplier or hosting provider that the exact production runtime includes a fix.
Verify, patch, then restore with evidence
The Dutch National Cyber Security Centre urged organizations to update and said systems that remain unpatched should stay offline as a precaution.
Inventory
Identify PHP runtimes serving requests across sites and environments.
Patch
Install a listed fixed release or verify a supplier backport.
Confirm
Check the runtime actually handling production traffic.
Restore
Bring services online after patch status is established.
Availability updates matter
The available statements do not specify exactly how long each named service was offline or whether every service has completed patching.
Ask for runtime confirmation
Request confirmation from providers for each relevant site and the PHP runtime serving it—not only the application code.
Keep the claims in proportion
Research and provider reports add context, but they do not establish that the Dutch services were attacked or breached.
Worker account
One advisory describes execution in a demonstrated out-of-memory case as the web worker account. That does not automatically mean administrator or root access.
Process memory
Wiz demonstrated disclosure of sensitive process memory, which could expose credentials or tokens even without code execution.
Attempts observed
Cloudflare reported attack traffic and attempts to alter payloads to bypass protections. This is not evidence the Dutch services were targets or victims.
OpenAI said Calif identified a critical flaw through its Patch the Planet initiative; Wiz reported independently discovering both vulnerabilities. PHP maintainers led the fixes and release. The government also said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
What operators and readers should know
Were Dutch government websites confirmed hacked?
No. The government said named sites were taken offline as a precaution and reported no signs of active exploitation at announcement time. The shutdown did not confirm a compromise.
What does PHP2Shell mean?
It is the name used for two PHP flaws: CVE-2026-109618 and CVE-2026-109619. They involve memory corruption and use-after-free conditions that may enable unauthenticated RCE in affected circumstances.
Does updating WordPress fix it?
No. These flaws are in PHP itself. Patch the runtime serving the site, and ask a managed-hosting provider to verify its production build.
Which versions include fixes?
PHP listed 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It also supplied minimal source backports for 7.4, 8.0 and 8.1; confirm vendor package status.
Does PHP-FPM avoid the flaws?
There is no basis to treat PHP-FPM as immune. Its handling differs in some cases, while research describes application-dependent exploitation paths.
What is still unknown?
Public statements do not establish exact downtime, patch completion for each named service, or which PHP configurations were present on each service.
Why PHP Runtime Patching Matters
PHP2Shell affects the PHP runtime beneath a website, rather than a particular content-management system. Updating WordPress, Drupal or Joomla code and plugins alone does not fix vulnerable PHP software. Site operators need to establish whether the runtime serving each site has been patched, including when hosting is managed by an outside provider.
Researchers reported demonstrations of unauthenticated code execution against Apache with mod_php. One advisory says execution in the demonstrated out-of-memory case runs as the web worker account; that does not automatically mean an attacker gains administrator or root privileges. Wiz also demonstrated disclosure of sensitive process memory, which could expose credentials or tokens even without code execution.
The impact is not limited to public agencies. PHP is used by a wide range of websites, so the advisories make the hosting stack a direct operational concern for businesses and service providers. Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. That report indicates attempted exploitation in the wider environment, not a breach of the Dutch services.
Products Worth Considering
Samsung Odyssey G9 QD-OLED 49 Dual QHD Curved Gaming Monitor
LG UltraGear 32-inch Curved QHD Gaming Monitor (2560×1440, 180Hz, 1ms, 1000R, HDR10)
DJI Mini 4 Pro Fly More Combo with DJI RC 2
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Reaches Websites
The two flaws involve PHP’s handling of internal memory and state when request processing is interrupted. In CVE-2026-109618, an out-of-memory failure can interrupt an operation before request data is fully initialized; cleanup may then handle invalid data as if it were valid, causing memory corruption. In CVE-2026-109619, internal state can retain references to request memory after that memory has been freed, creating a use-after-free condition.
PHP’s advisories and researchers describe remote code execution as a possible result, but exposure depends on the runtime and configuration. Demonstrations focused on Apache with mod_php. PHP-FPM handles some startup failures differently, but Calif’s technical research describes application-dependent exploitation paths involving PHP-FPM, so that difference is not proof that it is immune.
The disclosure also involved security research using AI tools. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz reported independently discovering both vulnerabilities. Wiz described using several AI systems in its research; Calif said its initial discovery used generally available models and emphasized the researcher’s role in directing investigation based on PHP vulnerability history. PHP maintainers led the fixes and release.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement
Which Services Were Exposed
It is not clear from the available statements exactly how long the named Dutch services remained offline, when each returned, or whether all have completed patching. The government’s announcement said it had no signs of active exploitation at that time, but that does not independently establish the status of every system or rule out later developments.
It is also not clear which specific PHP configurations or application paths, if any, were present on each affected government service. Cloudflare’s observations concern attack attempts generally and do not identify those services as targets or victims. Operators relying on hosting vendors may also need confirmation from those vendors that the actual serving runtime—not just the website application—has been updated.
Patch Verification and Service Restoration
Organizations should identify PHP runtimes handling web requests, apply the fixed release or a verified vendor backport, and confirm that the patched runtime is the one serving production traffic. The Dutch NCSC’s published guidance is to keep unpatched systems offline until they are updated. Managed-hosting customers should ask providers for confirmation covering each relevant site and runtime.
For Dutch public services, the next indicators are official updates on availability and patch status. PHP maintainers, security researchers and infrastructure providers may publish further technical details as analysis continues. Until then, the confirmed distinction remains: the sites were taken offline preventively, while the government reported no signs of active exploitation at the time of its statement.
Key Questions
Were Dutch government websites confirmed to be hacked?
No. The government said several sites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. That statement did not confirm a compromise.
What are PHP2Shell vulnerabilities?
PHP2Shell is the name used for two PHP flaws, CVE-2026-109618 and CVE-2026-109619. They involve memory corruption and use-after-free conditions that can lead to unauthenticated remote code execution in affected circumstances.
Does updating WordPress fix PHP2Shell?
No. These flaws are in the PHP runtime, not a WordPress plugin or theme. The runtime serving the site must be patched; managed-hosting customers should verify that their provider has updated it.
Which PHP versions include the fixes?
PHP listed fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for 7.4, 8.0 and 8.1. Operators using vendor packages should check with the supplier because a backport may not be apparent from the version number alone.
Does PHP-FPM avoid the vulnerabilities?
There is no basis to treat PHP-FPM as immune. Although it handles some startup failures differently from Apache with mod_php, Calif’s research describes application-dependent exploitation paths involving PHP-FPM. Exposure depends on deployment details.
Source: ThorstenMeyerAI.com
