🔍 Read the full analysis: PHP2Shell And Critical PHP Flaws: A Closer Look At Dutch Site Downtime on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency updates on October 21 for two critical flaws that can enable unauthenticated remote code execution. The Dutch government took several public websites offline as a precaution, while saying it had no signs those services were being actively exploited at the time. The vulnerabilities affect the PHP runtime, so updating a site’s application or plugins alone is not enough.
PHP released emergency security updates on October 21 for two critical vulnerabilities that can allow attackers to execute code remotely without logging in, prompting the Dutch government to take several public websites offline as a precaution. The government named Overheid.nl, MijnOverheid.nl and DigiD, but said it had no signs of active exploitation of those services when it announced the shutdowns.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, affect PHP’s handling of memory and internal request state. PHP’s security advisories assign both vulnerabilities a CVSS v4.0 score of 9.2, classified as Critical. The advisories identify PHP installations handling web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP said it released fixes for supported branches in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support. The project also supplied minimal source backports for versions 7.4, 8.0 and 8.1; organizations using vendor-maintained or extended-support packages should check for their provider’s fixed release. A version string alone may not show whether a vendor has backported a patch.
The Dutch government described its service shutdowns as preventive action, not confirmation of a breach. Its announcement said there were no signs of active exploitation at that time. It also said many government sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws. The Dutch National Cyber Security Centre later urged organizations to patch and said systems that remain unpatched should stay offline as a precaution.
Why Runtime Patching Matters
The vulnerabilities sit in the PHP runtime beneath a website’s application. Updating WordPress, Drupal, Joomla or their plugins does not, by itself, fix the affected PHP software. Website operators need to confirm that the runtime handling requests has been updated and that the patched version is the one actually serving traffic.
That distinction is especially important for organizations using managed hosting, where customers may not control the server software. They need confirmation from their provider that each affected PHP environment has been patched. Until that is established, an updated content-management system may still be running on a vulnerable runtime.
The possible consequences include remote code execution without authentication, as well as exposure of sensitive process memory in some demonstrated scenarios. PHP’s advisory says execution in the demonstrated out-of-memory case occurs as the web worker account; this does not automatically confer administrator or root privileges. The flaw can still put websites and information accessible to the service account at risk.
Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. That is evidence of attempted exploitation, not proof that the named Dutch services were compromised. The distinction matters when assessing the government’s precautionary shutdowns against broader reports of threat activity.
As an affiliate, we earn on qualifying purchases.
How the PHP Flaws Work
According to the security advisories, CVE-2026-109618 involves an out-of-memory failure that interrupts an operation before internal request data is fully initialized. Cleanup may then handle invalid data as if it were valid, causing memory corruption that can lead to remote code execution. CVE-2026-109619 is a use-after-free flaw: internal state can remain after the request memory it refers to has been released, leaving later processing to encounter stale references.
The affected deployment and configuration can influence exposure. Researchers demonstrated exploitation on Apache with mod_php, and some of those attacks occur before application code runs. Research by Calif describes application-dependent exploitation paths involving PHP-FPM; different handling of certain startup failures in PHP-FPM does not establish that it is immune. PHP identifies several other web-facing configurations as at risk as well.
Wiz researchers demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla deployments, and also demonstrated disclosure of sensitive process memory that could expose credentials or tokens without code execution. These examples show possible effects of flaws in the PHP engine, rather than separate vulnerabilities in each content-management system.
The disclosure also involved AI-assisted security research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz reported independently discovering both vulnerabilities. Calif’s account says the initial discovery used generally available models and involved a researcher directing the work with knowledge of PHP’s vulnerability history. PHP maintainers led the fixes and release.
“The websites were taken offline as a precaution.”
— The Dutch government
What Is Known About Exposure
The Dutch government’s statement did not report confirmed compromise of Overheid.nl, MijnOverheid.nl or DigiD; it said there were no signs of active exploitation when the sites were taken offline. It remains unclear from the supplied statements whether any of those services were later found to have been accessed, or when each service would return to normal operation.
Cloudflare’s observation of attack traffic does not identify the named Dutch sites as targets or establish that an attack succeeded. The supplied information also does not give a count of affected systems, successful compromises, or organizations that had completed patching. Exposure depends on the PHP version, hosting configuration and whether a vendor has applied a backport.
Research demonstrations establish potential impact in tested environments, but they do not show that every listed PHP deployment is equally exploitable. PHP-FPM and other configurations require assessment against their specific runtime and application setup; configuration differences should not be treated as proof of safety.
Patching and Service Restoration
Organizations should identify the PHP runtime and web-serving configuration behind each exposed site, install the fixed release or vendor package, and verify that the patched software is the version serving requests. Those on supported branches can check the October 21 updates; operators on older branches should consult their distribution or extended-support provider for a fixed package or plan an upgrade.
Until patching is confirmed, the Dutch NCSC advises keeping unpatched systems offline as a precaution. Hosting customers should ask providers for confirmation covering the affected websites and environments, rather than relying on an updated application dashboard. The Dutch government’s service announcements and further NCSC guidance will clarify restoration timing; the supplied material gives no confirmed reopening schedule.
Key Questions
What are PHP2Shell and the two vulnerabilities?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP’s handling of memory and request state. PHP says they can lead to remote code execution without a login.
Were Dutch government websites confirmed to be hacked?
No confirmed compromise of the named services is reported in the supplied government statement. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution and reported no signs of active exploitation at that time.
Does updating WordPress or a site’s plugins fix the problem?
No. The vulnerabilities affect the PHP runtime, not just website code or plugins. Operators need to confirm that the PHP software serving the site has received the relevant patch.
Which PHP versions include the fixes?
The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. PHP also provided minimal source backports for 7.4, 8.0 and 8.1; users of vendor packages should check directly with their provider.
What should an organization do if its PHP system is not patched?
Identify the affected runtime and obtain a fixed package from PHP or the relevant vendor. The Dutch National Cyber Security Centre advises that systems that remain unpatched should stay offline as a precaution.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
