🔍 Read the full analysis: What PHP2Shell Reveals About PHP Flaws And Dutch Government Site Outages on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get movie nights delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released emergency updates on Oct. 21, 2026, for two critical flaws known collectively as PHP2Shell, which can allow unauthenticated remote code execution in vulnerable deployments. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe faults involving memory handling and request state. One flaw can leave internal data incompletely initialized after an out-of-memory failure; the other can leave references to request memory after that memory has been freed. The resulting conditions can lead to memory corruption or use-after-free errors and, in affected circumstances, remote code execution. Both advisories assign the flaws a CVSS v4.0 score of 9.2, classified as critical.

PHP identifies web-facing installations as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The security team reports demonstrated exploitation on Apache with mod_php. That does not establish that every setup is exploitable in the same way: technical research cited by the source describes differences in how PHP-FPM handles some startup failures, as well as application-dependent paths. PHP’s advisory says execution in the demonstrated out-of-memory case runs as the web worker account, which does not by itself imply administrator or root access.

Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are outside normal upstream support, though the source reports minimal backports for versions 7.4, 8.0 and 8.1. Organizations using vendor-maintained or extended-support packages should check with their provider for a fixed build. A version number alone may not show whether a vendor has backported the security changes.

Why Runtime Patching Matters

The incident highlights a distinction that can be easy to miss during website maintenance: PHP is the runtime beneath the site, not the site’s content-management system or its plugins. Updating WordPress, Drupal or Joomla alone does not correct a flaw in the PHP engine serving those applications. Cloudflare’s guidance, as summarized in the source, says operators need to patch the runtime itself.

For businesses using managed hosting, the immediate issue is whether the provider has updated the PHP runtime attached to each affected site. Operators managing their own servers need to identify which PHP deployment handles web requests, apply the appropriate fixed package, and verify the patched runtime is actually serving traffic. The potential impact reaches beyond code execution: Wiz researchers demonstrated that sensitive process memory, including credentials or tokens, could be exposed in some scenarios without code execution.

The Dutch shutdowns show how a severe software flaw can affect public access even before a breach is established. Temporarily taking services offline can limit exposure while administrators assess systems and deploy fixes, but it can also interrupt access to government services. The source also reports that Cloudflare observed attack traffic and attempts to alter payloads to bypass protections. Those observations indicate exploitation attempts in the wider environment; they do not confirm a compromise of the named Dutch services.

Dutch Shutdowns and Patch Timeline

The Dutch government announced on Oct. 21 that several public-service websites were offline as a precaution while the PHP vulnerabilities were being addressed. Its statement said there were no signs of active exploitation at the time. It also said many government sites, including Rijksoverheid.nl, did not use PHP and were unaffected by these specific flaws.

The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. This sequence matters: the initial shutdown was a preventive measure, and the later guidance followed the availability of fixes. Neither statement, as presented in the source, says the named services were breached.

The discovery work also involved security researchers and AI tools, but the roles should be described carefully. The source says OpenAI credited Calif with identifying a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release. Calif’s account also says the researcher used generally available models and directed the investigation with knowledge of PHP’s vulnerability history; the source does not attribute the work to an autonomous system.

Exposure and Service Status

The source does not establish whether any of the affected Dutch sites were compromised, and the government’s statement specifically reported no signs of active exploitation at that time. It also does not give a complete account of when each service returned online or whether all operators have finished patching.

Exposure varies with the PHP version, server setup, configuration and application behavior. The reported demonstrations on mod_php and application-dependent research on PHP-FPM do not show that every installation is vulnerable in an identical way. Cloudflare’s account of attack attempts does not identify those attempts as successful against the Dutch services. The source also does not provide a full list of affected organizations or a confirmed count of systems exposed worldwide.

Patch Verification and Service Restoration

Organizations should identify every PHP runtime handling web requests, apply the fixed release or a vendor-confirmed backport, and verify the patched software is active on the systems serving their sites. Those relying on hosting companies should ask specifically whether the PHP runtime has been patched; an updated application dashboard does not answer that question.

Dutch authorities’ published guidance calls for unpatched systems to remain offline as a precaution. The source gives no timetable for the restoration of each government service, so operators and users will need to rely on updates from the relevant agencies. Further information about patch completion, service availability and any confirmed exploitation would clarify the scale and operational impact of the incident.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used in the source for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under affected conditions, they can lead to unauthenticated remote code execution.

Were the Dutch government websites hacked?

The source does not confirm a breach. The government said it took several sites offline as a precaution and reported no signs of active exploitation when it made its announcement.

Which PHP versions contain the fixes?

The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of distribution or extended-support packages should check with their vendor, since a backport may not be apparent from the version number alone.

Does updating WordPress fix PHP2Shell?

No. Updating WordPress or its plugins does not patch the PHP runtime. Operators need to confirm that the software running PHP has received the applicable fix.

Are all PHP deployments equally exposed?

The source does not support that conclusion. Risk depends on the PHP deployment and configuration; demonstrations include Apache with mod_php, and researchers also describe application-dependent paths involving PHP-FPM.

Source: ThorstenMeyerAI.com