🔍 Read the full analysis: PHP2Shell Exposes PHP Flaws While Dutch Government Websites Go Offline on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency fixes on Oct. 21 for two critical vulnerabilities that can enable unauthenticated remote code execution in affected PHP deployments. The Dutch government took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; it said it had no signs of active exploitation at the time of its announcement and did not report confirmed compromises of those services.
PHP released emergency security updates on Oct. 21 for two critical vulnerabilities that can allow unauthenticated attackers to execute code remotely, while the Dutch government took several public-service websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution. The government said it had no signs of active exploitation at the time of its announcement; it did not say the affected services had been compromised.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to together as PHP2Shell, affect PHP installations that handle web requests. PHP’s security advisories describe memory-management failures that can lead to corruption or use-after-free conditions, and then potentially to remote code execution. Both advisories carry a CVSS v4.0 score of 9.2, rated Critical.
PHP published fixes for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The fixes were released on Oct. 21. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using distribution packages or extended-support versions need to check with their vendor; an older version number alone does not show whether a security backport has been applied.
The affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP advisories. Demonstrations have shown exploitation on Apache with mod_php. PHP-FPM handles some startup failures differently, but that does not establish that all PHP-FPM deployments are safe; researchers have described application-dependent paths. The PHP runtime and its configuration determine the relevant exposure.
PHP2Shell Exposes PHP Flaws While Dutch Government Websites Go Offline
PHP issued emergency fixes for two critical flaws that may allow unauthenticated remote code execution. Dutch authorities took several public service websites offline as a precaution, reporting no signs of active exploitation at the time of their announcement.
What happened
One runtime flaw can affect many different sites. The security issue sits in PHP itself, rather than in a specific content management system.
Memory handling under scrutiny
PHP advisories describe memory management failures that can cause corruption or use after free conditions, potentially leading to remote code execution.
Unauthenticated code execution
Under certain conditions, a remote attacker may execute code without logging in. A demonstrated flaw may run as the web worker account, not automatically as administrator or root.
Availability meets security
Overheid.nl, MijnOverheid.nl and DigiD were among the sites taken offline. Precaution can limit exposure while checks proceed, but interrupts access to public services.
Patch the runtime
Application updates alone do not fix PHP2Shell. Confirm the PHP version serving web requests and make sure the patched runtime is active.
Released October 21. Minimal source backports were also supplied for versions 7.4, 8.0 and 8.1, which are outside normal upstream support.
- Affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
- Distribution packages and extended support builds may carry verified backports.
- Check with the supplier; an older version number alone does not confirm patch status.
From disclosure to response
Timelines and exposure vary by deployment. Demonstrations show specific conditions; they do not establish that every PHP installation is exploitable in the same way.
PHP releases fixes
Emergency security updates address two critical vulnerabilities.
Dutch sites go offline
Authorities take several public service sites offline before patches are available.
NCSC urges updates
Unpatched systems should remain offline as a precaution, according to its advice.
Verify and restore
Operators patch, check their systems and determine when services can safely return.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
Dutch government announcementExposure is deployment specific
The PHP runtime, configuration and application shape the relevant exposure. A platform name by itself does not determine whether a site is vulnerable.
| Question | What the reports say | What it does not establish |
|---|---|---|
| WordPress, Drupal, Joomla | Researchers demonstrated code execution on deployments of each platform. | These are PHP runtime flaws, not separate platform vulnerabilities. |
| PHP-FPM | Some startup failures are handled differently; researchers describe application dependent paths. | That all PHP-FPM deployments are safe. |
| Dutch government sites | The announcement reported no signs of active exploitation at that time. | That named sites were compromised, or that no attempts occurred later. |
| Cloudflare observations | Attack traffic and attempts to alter payloads to evade protections were reported. | That the named Dutch websites were compromised. |
Operator checklist
Use this sequence to confirm the fix reaches the PHP process that actually handles requests.
Identify the runtime
Inventory PHP versions and configurations serving each site, including PHP-FPM, mod_php and managed environments.
Patch or verify backport
Install a listed fixed release or confirm with the package vendor that a security backport is present.
Confirm and restore
Check that the patched runtime is active. Follow NCSC guidance and keep unpatched systems offline as a precaution.
Managed hosting?
Ask the provider whether the PHP runtime behind each site has been patched. Updating WordPress, Drupal or Joomla alone is not a substitute.
Research context
Wiz reported discovering and disclosing both flaws. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol; PHP maintainers handled the fixes and release.
Why PHP Runtime Patching Matters
PHP underpins many websites and online services, so a flaw in the runtime can affect sites built on different applications, rather than only one content-management system. Researchers demonstrated unauthenticated code execution against deployments of WordPress, Drupal and Joomla. Those demonstrations concern vulnerabilities in PHP itself, not separate flaws in each platform.
Updating an application or its plugins does not patch the PHP engine. Website operators need to confirm that the runtime serving each site has been updated, including where hosting is managed by a provider. The PHP advisory says one demonstrated flaw can run code as the web worker account; that does not automatically mean administrator or root access. Researchers also demonstrated that sensitive process memory, potentially including credentials or tokens, could be exposed in some circumstances without code execution.
The Dutch shutdowns show the service impact of precautionary security decisions: taking public websites offline can limit exposure while operators check systems and apply fixes, but it also interrupts access to government services. The reported shutdowns should not be read as proof that those services were attacked successfully.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and Patch Timeline
The Dutch government’s Oct. 21 statement said several websites were taken offline because of the PHP vulnerabilities and as a precaution, before patches were available. It said there were no signs of active exploitation at the time. The statement also clarified that many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to update. Its guidance says systems that have not been updated should remain offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to get around its protections. That is evidence of attempted exploitation observed by a security provider, not evidence that the named Dutch websites were compromised.
Research accounts also describe AI tools being used in vulnerability discovery and analysis. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative; Wiz separately reported discovering and disclosing both vulnerabilities. PHP’s maintainers handled the fixes and release. Calif’s account says the work involved a researcher directing the investigation with knowledge of PHP’s vulnerability history, rather than autonomous discovery.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
Exposure and Service Status
The available statements do not identify whether any of the affected Dutch services were vulnerable in practice, whether investigators found attempted attacks against those specific sites, or when each service would return online. The government’s statement reported no signs of active exploitation at that time, but that assessment is time-specific and is not proof that no attempts occurred later.
PHP’s advisories and the research reports describe demonstrated exploitation under particular conditions. They do not establish that every PHP deployment can be exploited in the same way. Exposure can depend on the runtime, configuration and application. It is also not clear from the source material how many organizations have installed the fixes or which hosting providers have completed patching.
As an affiliate, we earn on qualifying purchases.
Patch Checks and Service Restoration
Organizations running PHP should identify the runtime versions serving their web requests, apply the relevant fixed release or verified vendor backport, and confirm that the patched runtime is actually active. Sites that remain unpatched should follow the Dutch NCSC’s advice to stay offline as a precaution. Managed-hosting customers should ask their provider whether the PHP runtime behind each site has been patched; updating WordPress, Drupal or Joomla alone is not a substitute.
Dutch agencies will need to determine whether affected services can safely return after patching and checks. The source material does not provide a restoration schedule. Further updates from the government, the NCSC, PHP maintainers and hosting providers may clarify service availability, patch status and any later evidence of exploitation.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP flaws involving memory or internal-state handling. Under certain conditions, they can lead to unauthenticated remote code execution.
Were the Dutch government websites confirmed to be hacked?
No confirmed compromise was reported in the government announcement. It said the sites were taken offline as a precaution and that there were no signs of active exploitation at the time of that statement.
Which PHP versions contain the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1; users of vendor or extended-support packages should confirm the fix with their supplier.
Does updating a website’s plugins fix PHP2Shell?
No. The vulnerabilities are in the PHP runtime, so updating application code or plugins alone does not resolve them. Operators need to confirm that the PHP software serving the site has been patched.
Does every PHP-FPM website have the same exposure?
No. Exploitability can depend on configuration and application behavior. Different handling of some startup failures does not establish that PHP-FPM is immune, so operators should apply the fix and follow their vendor’s security guidance.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
