🔍 Read the full analysis: Why PHP2Shell Matters As Dutch Government Websites Go Offline on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl, DigiD and other websites offline on 21 October 2026 as a precaution over two critical PHP vulnerabilities, collectively called PHP2Shell. It reported no signs of active exploitation at the time, and the shutdown was not evidence that those services had been compromised. PHP has released fixes, and the Dutch National Cyber Security Centre urged operators to patch affected runtimes.
The Dutch government took several websites offline, including Overheid.nl, MijnOverheid.nl and DigiD, on 21 October 2026 as a precaution over two critical vulnerabilities in PHP, the software runtime used to serve many websites. PHP released security updates that day, but the government said its shutdown announcement was preventive action, not confirmation of a breach, and reported no signs of active exploitation at the time.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, can under certain conditions allow an unauthenticated attacker to execute code remotely. PHP’s security advisories assign both flaws a CVSS v4.0 score of 9.2, rated Critical. The affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed when they handle web requests.
PHP’s security team released patched versions on 21 October for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although the project also provided minimal source backports for versions 7.4, 8.0 and 8.1. Operators using distribution packages or extended support need to check with their supplier for a fixed package; a version number by itself may not show whether a vendor backport has been applied.
The Dutch National Cyber Security Centre said patches were available and urged organizations to update. Its guidance says systems that have not been updated should remain offline as a precaution. The government also said many of its websites, including Rijksoverheid.nl, do not use PHP and were not affected by these specific flaws.
Cybersecurity briefing · The Netherlands · 21 October 2026
Why PHP2Shell Matters as Dutch Government Websites Go Offline
Several public services were taken offline as a precaution after two critical PHP flaws were disclosed. The shutdown signaled risk management; it did not confirm a breach.
The key distinction
Protective shutdown ≠ confirmed compromiseThe government reported no signs of active exploitation when it announced the precautionary action.
Critical severity
01 · What happened
A precaution, prompted by the runtime
The Dutch government took several sites offline on the same day PHP published security updates. It said the move was preventive action, not confirmation of an intrusion.
Public services
Access paused
Overheid.nl, MijnOverheid.nl, DigiD and other websites were taken offline while operators assessed exposure.
Rijksoverheid.nl and many other government sites do not use PHP and were not affected by these specific flaws.
Potential impact
Remote code execution
Under affected conditions, an unauthenticated attacker could execute code remotely. Demonstrations ran as the web worker account.
That does not automatically mean administrator or root access.
Evidence boundary
Risk is not proof
Security research and observed attack attempts show potential impact and attempted exploitation.
They do not establish that the named Dutch services were attacked or that data was accessed.
02 · The vulnerability
Two memory flaws, one urgent patch
PHP2Shell is the collective name for two critical vulnerabilities in PHP’s handling of memory and request state during interrupted processing.
Where exposure can occur
Affected setups include web-facing PHP configurations. Actual exposure depends on runtime version, server configuration and application behavior.
03 · How the issue unfolds
From interrupted request to exposure
The two flaws involve different memory-handling failures. Both can create a path to remote code execution under affected conditions.
Request interrupted
Processing encounters a failure, such as an out-of-memory condition.
Request state at riskMemory mishandled
Uninitialized data or a reference to freed memory may be treated as valid.
Two flaw pathsCorruption possible
Under affected configurations, the flaw can permit remote code execution.
Unauthenticated riskPatch and verify
Install a fixed runtime or vendor backport, then confirm the web service uses it.
Close the exposure04 · What is known
Keep confirmed facts separate from open questions
Provider observations, research demonstrations and government statements describe different things. Reading them precisely matters.
Precaution taken
The Dutch government took several sites offline and reported no signs of active exploitation at the time of its statement. PHP fixes were released.
Attack attempts reported
Cloudflare observed attack traffic and payload changes intended to bypass protections. This is not proof of a successful attack on Dutch services.
Compromise or timeline
The supplied information does not establish a breach, data access, each system’s exposure, or when every service will return.
05 · Operator response
Patch the runtime. Verify the running service.
Use a fixed release for the supported branch or a verified security backport from the operating-system or hosting supplier.
Identify each PHP runtime
Check the PHP installation and configuration serving every web-facing application, including outsourced hosting.
Apply a fixed package
Use the patched upstream release or confirm that your vendor has applied a security backport.
Confirm the patched runtime is live
A package version alone may not reveal a vendor backport. Verify what the web-facing service is actually using.
Keep unpatched systems offline
The Dutch NCSC urged operators to update and advised that systems not yet updated remain offline as a precaution.
06 · Quick answers
Questions operators and visitors may ask
Three practical points help make sense of the shutdown and the response.
What is PHP2Shell?
The collective name for CVE-2026-109618 and CVE-2026-109619. Under affected conditions, the flaws can allow unauthenticated remote code execution.
Were the Dutch sites confirmed hacked?
No. The government described a precautionary shutdown and reported no signs of active exploitation at the time. Its announcement did not confirm a compromise.
Does updating WordPress fix it?
No. PHP2Shell affects the PHP runtime. Updating a site’s CMS or plugins does not replace patching and verifying that runtime.
Why Runtime Patching Matters
PHP2Shell affects the runtime beneath a website, not just the site’s visible pages or content-management system. Updating WordPress, Drupal or Joomla code and plugins alone does not fix an unpatched PHP installation. Hosting providers and site operators must establish whether the runtime serving each site has been updated and whether the patched version is actually in use.
That distinction matters for organizations that outsource hosting: a customer may not control the server, but still needs confirmation from its provider that the relevant PHP runtime and configuration are patched. Until that is verified, taking a service offline can reduce exposure, though it also interrupts access to public information and services. The Dutch shutdown shows how a software vulnerability can prompt protective steps across government services even when a compromise has not been established.
Security researchers reported demonstrations of unauthenticated code execution on particular deployments, and Wiz also described tests that exposed sensitive process memory, potentially including credentials or tokens. These findings show potential impact; they do not establish that the Dutch services were attacked or that data was accessed. The PHP advisory also says demonstrated execution ran as the web worker account, which does not automatically mean administrator or root access.
As an affiliate, we earn on qualifying purchases.
How PHP2Shell Reached Public Services
The flaws concern PHP’s handling of internal memory and request state when processing is interrupted. In CVE-2026-109618, an out-of-memory failure can interrupt an operation before request data is fully initialized; cleanup may then treat invalid data as valid, causing memory corruption. CVE-2026-109619 involves internal state retaining references to request memory after that memory has been freed, creating a use-after-free condition. Both flaws can lead to remote code execution under affected conditions.
PHP reports demonstrated exploitation on Apache with mod_php. Other configurations require careful assessment rather than assumptions: PHP-FPM handles some startup failures differently, but research from Calif describes application-dependent exploitation paths involving PHP-FPM. That difference does not amount to a general finding that PHP-FPM is safe.
Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations concern attempted exploitation and do not prove that the named Dutch sites were compromised. The discovery accounts also describe work by security researchers: OpenAI said Calif identified a critical flaw with GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers issued the fixes, with support from researchers and infrastructure providers.
“There were no signs of active exploitation at the time of its statement.”
— The Dutch government
What Is Still Unconfirmed
The available statements do not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised, or that attackers accessed data from those services. The Dutch government reported no signs of active exploitation when it announced the precautionary shutdown. Cloudflare’s reported attack traffic is evidence of attempted exploitation observed by that provider, not evidence of a successful attack against the Dutch sites.
It is not clear from the supplied information exactly when each affected service will return, which specific systems were found to be vulnerable, or whether every organization using PHP has completed patching. Exposure can depend on the PHP version, server configuration and application. Operators should verify the actual runtime and vendor package rather than infer protection from a site’s CMS version or a version number alone.
Patch Verification and Service Restarts
Organizations running affected PHP installations should apply the fixed release for their supported branch, or obtain a verified security backport from their operating-system or hosting vendor. They should then confirm that the web-facing service is using the patched runtime. The Dutch NCSC’s published advice is to keep systems offline if they have not been updated.
For Dutch government services, the next visible development is the return of sites once the responsible operators have assessed and addressed exposure. The source material does not give a restoration timetable. Website owners using managed hosting should ask providers directly whether each affected runtime has been patched; maintaining an updated application or plugin list is not a substitute for that check.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under affected conditions, they can allow unauthenticated remote code execution.
Were Dutch government websites confirmed hacked?
No. The government said several websites were taken offline as a precaution and reported no signs of active exploitation at the time. The announcement does not confirm a compromise.
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP runtime, which is separate from WordPress and its plugins. Operators need to verify that the PHP software serving the site has received the relevant fix.
Which PHP versions have fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations on older branches should check with their package or hosting provider for a security backport or move to a supported branch.
Does PHP-FPM avoid the vulnerabilities?
Not on the basis of the available information. PHP-FPM handles some failures differently from Apache with mod_php, but Calif describes application-dependent exploitation paths involving PHP-FPM. Operators need to assess and patch their specific deployment.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
