🔍 Read the full analysis: What PHP2Shell Means For PHP Security And Dutch Government Websites on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

PHP released emergency security updates on 21 October for two critical flaws, collectively called PHP2Shell, that can allow attackers to execute code remotely without logging in. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not report that those services had been compromised.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP’s advisories assign each a CVSS v4.0 score of 9.2, rated Critical. They concern failures in PHP’s handling of memory and internal request state. One flaw can leave request data improperly initialized after an out-of-memory failure; the other can leave internal references to memory after that memory has been freed. The resulting memory corruption or use-after-free conditions can lead to remote code execution.

PHP says installations that handle web requests may be at risk. Named configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP’s advisories report demonstrated exploitation on Apache with mod_php. A separate technical analysis describes application-dependent routes involving PHP-FPM, so the different handling of some startup failures does not establish that PHP-FPM systems are immune. The documented execution context is the web worker account; that does not by itself mean an attacker gains administrator or root access.

Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using distribution packages or extended-support versions need to check with their supplier for a fixed package. Version numbers alone may not show whether a vendor has applied a backport.

Why PHP Runtime Patches Matter

PHP2Shell affects the runtime that serves a website, not just its content-management system or plugins. Updating WordPress, Drupal or Joomla code alone does not patch the PHP engine underneath it. Operators need to confirm that the PHP version actually handling requests has been updated, including where a hosting provider manages the server.

The reported impact reaches beyond the possibility of code execution. Wiz researchers demonstrated unauthenticated code execution against deployments of WordPress, Drupal and Joomla, and also demonstrated disclosure of sensitive process memory. Such memory can contain credentials or tokens, although disclosure is not the same as successful code execution. These are demonstrations of the PHP flaws’ potential effects, not evidence that every installation of those applications is affected or that the named Dutch services suffered an intrusion.

For public services, taking a website offline can limit exposure while operators assess and patch systems, but it also interrupts access for residents and businesses. The Dutch action illustrates that service availability and security response may need to be balanced while the affected runtime is checked. The government said some other sites, including Rijksoverheid.nl, do not use PHP and were not affected by these vulnerabilities.

Dutch Shutdowns and Exploit Reports

The Dutch government said on 21 October that it had taken several websites offline as a precaution. It reported no signs of active exploitation at the time of its statement. That is a time-specific assessment, not proof that no exploit attempts occurred elsewhere or that every system was free of exposure.

The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that had not been patched should remain offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass protections. Those observations indicate attempted exploitation; they do not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised.

Researchers also described AI-assisted work in the discovery and analysis of the flaws. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz said it independently discovered and reported both vulnerabilities. Calif’s account says its researcher directed the investigation using knowledge of PHP’s vulnerability history. These descriptions concern research methods; PHP’s maintainers issued the security fixes.

“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”

— Dutch government

Exposure and Compromise Still Unclear

The available statements do not establish whether attackers accessed or compromised any of the Dutch websites taken offline. The government reported no signs of active exploitation at the time of its announcement; Cloudflare separately reported attempted exploitation in traffic it observed. Those accounts address different observations and do not confirm an intrusion into the named public services.

Exposure depends on the PHP runtime, configuration, application behavior and patch status. Research describes different paths across server setups, and a website’s visible application version does not establish the state of its underlying PHP runtime. It is also not yet clear from the supplied reports how long each Dutch service would remain unavailable or when operators would complete their checks.

Patch, Verify, Restore Services

Organizations should apply the appropriate PHP security release or obtain confirmation that their distribution or hosting provider has installed a fixed backport. They should then verify the runtime serving each affected site, rather than relying on an application or plugin update. The Dutch NCSC’s published advice is to keep unpatched systems offline as a precaution.

For government services, the next public developments are likely to include whether sites return online and whether officials disclose any change in their assessment. PHP operators and service providers will need to check deployments across supported and extended-support branches. No restoration timetable or confirmed compromise report for the named Dutch services appears in the source material.

Key Questions

What is PHP2Shell?

PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says they can lead to remote code execution without authentication.

Were Dutch government websites hacked?

The government said several sites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution. It reported no signs of active exploitation at the time of its statement, and the supplied material does not confirm that those sites were compromised.

Does updating WordPress fix PHP2Shell?

No. The flaws affect the PHP runtime, so updating WordPress, its themes or its plugins alone does not apply the PHP security fixes. Site owners using managed hosting should ask whether the provider patched the runtime serving their sites.

Which PHP versions include the fixes?

The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied source backports for versions 7.4, 8.0 and 8.1; users of vendor packages should check whether their supplier has issued a fixed package.

Do the reports of attack traffic prove the Dutch sites were breached?

No. Cloudflare reported observing attack traffic and attempts to bypass protections, but that does not establish a compromise of the named Dutch services. The government’s precautionary shutdowns and Cloudflare’s broader traffic observations are separate facts.

Source: ThorstenMeyerAI.com