🔍 Read the full analysis: A Guide To The PHP Flaws Exposed By PHP2Shell And Dutch Site Outages on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released security updates on Oct. 21 for two critical vulnerabilities that can permit unauthenticated remote code execution. Dutch government services including Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution; the government said it had no signs of active exploitation at the time of its announcement.
PHP released emergency security updates on Oct. 21 for two critical vulnerabilities, collectively called PHP2Shell, that can allow unauthenticated remote code execution. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution, while reporting no signs of active exploitation at the time of its announcement; the shutdown was not confirmation that those services had been breached.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories give both a CVSS v4.0 score of 9.2, rated Critical. The vulnerabilities affect PHP installations processing web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk depends on how PHP is deployed and configured.
PHP’s advisories describe two different memory-management failures. In CVE-2026-109618, an out-of-memory failure can interrupt an operation before request data is fully initialized, after which cleanup may handle invalid data as if it were valid. That can cause memory corruption. CVE-2026-109619 involves internal state retaining references to request memory after that memory has been freed, creating a use-after-free condition. Both problems can lead to remote code execution.
PHP released fixes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1. Operators using those versions, or vendor-managed packages, need to check for a fixed package from their provider rather than relying on the version number alone.
Why PHP Runtime Patching Matters
PHP2Shell affects the runtime beneath websites, not just the content management system or application code. Updating WordPress, Drupal, Joomla or their plugins alone does not repair a vulnerable PHP installation. Operators need to establish whether the PHP runtime serving each site has been patched, including when hosting is managed by another company.
The potential impact is serious because the flaws may let an attacker run code without logging in. PHP reports demonstrated exploitation on Apache with mod_php, and the advisory for the out-of-memory flaw says execution occurs as the web worker account. That does not automatically mean administrator or root access; the permissions and reach of the worker account matter. Researchers also demonstrated sensitive process-memory disclosure, which could expose credentials or tokens even without code execution.
For public services, taking systems offline can reduce exposure while operators assess and patch them, but it interrupts access to essential information and services. The Dutch action shows how a vulnerability can drive precautionary operational decisions before a compromise is confirmed. It also makes clear why the status of a particular service should not be inferred from broader reports of attack attempts.
As an affiliate, we earn on qualifying purchases.
Dutch Outages and PHP Exposure
The Dutch government said on Oct. 21 that Overheid.nl, MijnOverheid.nl and DigiD, among other sites, had been taken offline as a precaution. Its announcement said there were no signs of active exploitation at that point. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. Those observations indicate attempted exploitation, but do not establish that the named Dutch services were targeted successfully or compromised.
Research accounts describe different contributions to identifying and testing the flaws. OpenAI said Calif found a critical flaw through its Patch the Planet initiative; Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes and release. Calif said its initial discovery used generally available AI models under the direction of a researcher familiar with PHP’s vulnerability history. These accounts describe the research process, not a change to the patching advice.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
Which Systems Were Actually Compromised
The Dutch government reported no signs of active exploitation when it announced the shutdowns, but that statement does not establish the security status of every PHP deployment or rule out later discoveries. The available source material does not confirm that Overheid.nl, MijnOverheid.nl or DigiD were compromised. Cloudflare’s reported attack traffic likewise does not identify those public services as successful targets.
It is also not clear from the available information how many organizations were exposed, how many have patched, or how long the Dutch services remained offline. Exposure varies by runtime, configuration and hosting arrangement. PHP-FPM handles some startup failures differently from mod_php, but research describes application-dependent exploitation paths involving PHP-FPM; that difference should not be treated as proof of immunity.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Operators should apply the fixed PHP release or the appropriate vendor backport, then verify that the patched runtime is actually serving each affected website. Organizations using hosting providers need confirmation that the provider updated the runtime for their specific services. Updating application code or plugins alone is not a substitute.
For systems that cannot yet be patched, the Dutch NCSC’s published guidance is to keep them offline as a precaution. The next public developments to watch are whether Dutch authorities restore the affected sites, whether officials report any evidence of compromise, and whether hosting and software vendors issue further package or mitigation guidance. Until those details are available, the confirmed picture remains a critical PHP flaw disclosure, emergency fixes, precautionary shutdowns and reported attempts to exploit the vulnerabilities.
web application security testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both involve memory or internal-state handling and can lead to unauthenticated remote code execution.
Were the Dutch government websites confirmed to be hacked?
No. The Dutch government said the websites were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. The supplied information does not confirm a compromise of Overheid.nl, MijnOverheid.nl or DigiD.
Which PHP releases include the fixes?
The listed fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1. Users of vendor or extended-support packages should check with their provider for a fixed package.
Does updating WordPress fix PHP2Shell?
No. The flaws affect the PHP runtime, so updating WordPress, its plugins or other application code alone does not fix them. The operator or hosting provider must patch the PHP software serving the site.
Does the PHP-FPM deployment model eliminate the risk?
No. The source material says PHP-FPM handles some startup failures differently from mod_php, but also cites application-dependent exploitation paths involving PHP-FPM. Operators should patch and assess their specific configuration rather than assume it is unaffected.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
