🔍 Read the full analysis: Making Sense Of PHP2Shell And The Offline Dutch Government Websites on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency fixes on October 21 for two critical vulnerabilities that can enable unauthenticated remote code execution. The Dutch government temporarily took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs those services had been actively exploited at that time.
PHP released emergency security updates on October 21 for two critical flaws that can let attackers run code remotely without logging in, while the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. The government said it had no signs of active exploitation of those services when it announced the shutdowns; taking them offline was a preventive measure, not confirmation they had been breached.
The flaws, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s advisories give both a CVSS v4.0 score of 9.2, classified as critical. They affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP’s technical descriptions link the vulnerabilities to interrupted request processing and mishandled internal memory or state. One flaw involves cleanup after an out-of-memory failure; the other involves outdated references to memory that has been freed. The resulting conditions can lead to memory corruption or use-after-free behavior and, in demonstrated cases, remote code execution. PHP reports exploitation demonstrations on Apache with mod_php. Execution as a web worker account does not automatically mean access to administrator or root privileges.
Fixes were published for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1 because those branches are outside normal upstream support. Organizations using older branches or vendor-maintained packages need to check with their distributor or extended-support provider: a version number by itself does not show whether a backport has been applied.
Why Public Services Went Offline
The shutdowns show how a flaw in a widely used server-side runtime can affect access to public services even when there is no public evidence that those particular sites have been compromised. The Dutch government chose to reduce exposure before patches were available. Its announcement said that many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these vulnerabilities.
The risk applies below the level of a website’s content-management system. Updating WordPress, Drupal or Joomla code alone does not fix an exposed PHP runtime. Researchers at Wiz demonstrated unauthenticated code execution on deployments using those systems, but described the issue as a PHP engine vulnerability, not three separate flaws in the applications. Wiz also demonstrated potential disclosure of sensitive process memory, including credentials or tokens, without code execution.
For organizations using managed hosting, the operational question is whether the provider has patched the specific PHP runtime serving each site. A website owner may not control that software directly, and a current application dashboard does not establish that the underlying runtime is fixed. The Dutch National Cyber Security Centre’s published guidance says systems that have not been updated should remain offline as a precaution.
PHP security patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Scope and Attack Reports
The two issues concern internal handling of request data when processing is interrupted or when state persists beyond the memory it refers to. PHP’s advisories describe the potential security consequences, and research cited by the source material reports that exploitability can depend on the server setup. Demonstrations on Apache with mod_php do not establish that every PHP deployment is equally exposed. At the same time, differences in how PHP-FPM handles certain startup failures do not establish that PHP-FPM is immune; Calif describes application-dependent exploitation paths involving it.
The response developed over October 21. The Dutch government initially described taking named services offline as a precaution and reported no signs of active exploitation at that point. PHP then made fixes available, and the Dutch NCSC urged organizations to apply them. Cloudflare reported observing attack traffic and attempts to modify payloads to bypass its protections. Those observations concern attempted exploitation in general; they do not establish a compromise of the Dutch government websites.
The source material also reports that researchers used AI tools as part of vulnerability research. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. Calif’s account says generally available models were used and describes the researcher directing the investigation with knowledge of PHP’s vulnerability history. PHP’s maintainers handled the fixes and release.
“The websites were taken offline as a precaution; the announcement reported no signs of active exploitation at that time.”
— Dutch government announcement
Exposure and Breach Status
The available information does not establish whether any of the named Dutch services were compromised, or whether attackers successfully exploited PHP2Shell against other organizations. The Dutch government said it had no signs of active exploitation when it announced the shutdowns, while Cloudflare separately reported observing attack attempts. Those statements concern different evidence and should not be treated as contradictory proof of a breach.
Exposure also depends on the PHP version, server configuration, hosting setup and application behavior. The advisories and demonstrations identify affected deployment types, but they do not show that every installation is exploitable in the same way. It is not yet clear from the supplied material when all affected Dutch services will return or how many operators have completed patching.
Patch Verification and Service Returns
Operators should apply the fixed PHP release or a verified vendor backport, then confirm that the patched runtime is the one actually serving web requests. Organizations whose systems remain unpatched should follow the Dutch NCSC guidance and keep them offline as a precaution. Businesses on managed hosting should ask providers for confirmation about affected runtimes and the timing of remediation.
The next public developments to watch are service restoration notices from the Dutch government and further guidance from PHP, the NCSC and hosting vendors. The supplied announcements do not give a timetable for bringing Overheid.nl, MijnOverheid.nl or DigiD back online. Until operators verify fixes and authorities provide updates, the scale of exposure and any effect beyond the precautionary shutdowns remain unresolved.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No. The government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution and reported no signs of active exploitation of those services when it made the announcement. The supplied material does not confirm a breach.
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They involve mishandled memory or internal state during request processing and can lead to remote code execution in demonstrated conditions.
Does updating WordPress fix these vulnerabilities?
No. The vulnerabilities affect the PHP runtime beneath the website application. Updating WordPress, its themes or plugins does not by itself patch PHP; the operator or hosting provider must update the runtime or apply a verified vendor fix.
Which PHP releases include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also issued minimal source backports for 7.4, 8.0 and 8.1. Users of vendor or extended-support packages should check that provider’s fixed package rather than relying on the version number alone.
Are all PHP websites equally at risk?
The supplied advisories identify several web-request handling setups as affected, but the technical research says exploitability can depend on configuration and application behavior. Demonstrations on one server setup do not prove identical exposure across every deployment, nor do differences in PHP-FPM behavior establish immunity.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
