🔍 Read the full analysis: PHP2Shell And The Offline Dutch Government Websites: Key Details on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency fixes on October 21, 2026, for two critical vulnerabilities that can enable unauthenticated remote code execution. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement reported no signs of active exploitation of those services at that time.
PHP released emergency fixes on October 21 for two critical vulnerabilities known collectively as PHP2Shell, after which the Dutch government said it had taken several public-service websites offline as a precaution. The government named Overheid.nl, MijnOverheid.nl and DigiD and said it had no signs of active exploitation at the time of its announcement; it did not report that those sites had been compromised.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe memory-management failures that may lead to remote code execution without authentication. Both have a CVSS v4.0 score of 9.2, rated Critical. PHP identifies web-request installations as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The vulnerabilities involve different failure modes. The first concerns an out-of-memory error that interrupts an operation before request data is fully initialized; cleanup may then handle invalid data as if it were valid. The second involves internal state retaining references to memory after that memory has been freed. PHP’s advisories say these conditions can lead to code execution. In a demonstrated Apache mod_php case, the first flaw could run code as the web worker account; that does not by itself mean an attacker gains administrator or root access.
PHP published fixed releases for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also made minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using vendor-maintained or extended-support packages need to check for their provider’s fixed package: a version number alone may not show whether a backport has been applied.
PHP2Shell And The Offline Dutch Government Websites
PHP issued emergency fixes for two critical flaws that may allow unauthenticated remote code execution. The Netherlands took several public service websites offline as a precaution while assessing the risk.
Overheid.nl, MijnOverheid.nl and DigiD were taken offline. The announcement reported no signs of active exploitation at that time.
The cited material does not confirm that the named services were compromised.
Memory failures can open a path to code execution
PHP advisories describe two different memory management failures. In affected web request deployments, either may lead to remote code execution without authentication.
Interrupted initialization
An out of memory error can interrupt an operation before request data is fully initialized. Cleanup may then treat invalid data as valid.
Stale memory references
Internal state can retain references to memory after it has been freed, creating conditions PHP says may lead to code execution.
Web worker privileges
A demonstrated Apache mod_php case ran code as the web worker account. That alone does not mean administrator or root access.
Patch the PHP runtime serving each site
The flaw is in PHP itself. Updating WordPress, Drupal or Joomla, or installing a plugin update, does not patch the runtime beneath the application.
Review PHP version, vendor package, server setup and application behavior.
Confirm the fixed release or a vendor backport for the package in use.
Make sure the patched runtime is the one actually handling web traffic.
Keep systems that remain unpatched offline, as advised by the Dutch cyber centre.
Separate the evidence from the unknowns
Reported
- The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution.
- It reported no signs of active exploitation at the time of its announcement.
- The Dutch National Cyber Security Centre urged organizations to patch and advised unpatched systems to remain offline.
- Cloudflare reported attack traffic and attempts to alter payloads to bypass protections.
Not established here
- Whether the named Dutch services were compromised.
- A complete list of affected government services or a consolidated count of confirmed breaches.
- When each site was patched or restored; no restoration schedule was provided in the cited material.
- Whether every installation is exposed: configuration, PHP package and application behavior matter.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
Dutch government announcement · October 21, 2026Exposure depends on the actual deployment
PHP identifies web request installations as potentially at risk. Setup details can change how a failure occurs, so operators should assess their own environment rather than infer safety from a CMS update or a general server label.
Web request handlers
PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are among the installations PHP identifies for review.
CMS deployments
Researchers demonstrated execution in WordPress, Drupal and Joomla deployments. These are demonstrations of PHP engine flaws, not separate CMS vulnerabilities.
Vendor backports
PHP made minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. A version number alone may not reveal whether a vendor fix is present.
How the incident unfolded
Two memory handling vulnerabilities receive emergency fixes.
Named Dutch public service sites are shut down as a precaution.
Providers and administrators check packages, configurations and exposure.
Watch for agency updates, security guidance and revised assessments.
Quick answers
What is PHP2Shell?
A collective name for CVE-2026-109618 and CVE-2026-109619, PHP memory handling flaws that can lead to unauthenticated remote code execution.
Were the Dutch sites hacked?
The government reported precautionary shutdowns and no signs of active exploitation at the time. The cited material does not confirm a compromise.
Does a CMS update fix it?
No. Operators need to patch the PHP runtime or confirm a vendor backport, then verify the fixed runtime is serving requests.
Why PHP Runtime Patching Matters
PHP2Shell affects the runtime beneath a website, not just the site’s content-management system or plugins. Updating WordPress, Drupal or Joomla alone does not correct a vulnerable PHP installation. Security company Cloudflare warned that website operators need to confirm that the PHP runtime serving their sites has been patched.
Researchers at Wiz demonstrated unauthenticated code execution in deployments of WordPress, Drupal and Joomla, and described possible disclosure of process memory, which could expose credentials or tokens even without code execution. These are demonstrations of the PHP engine flaws, not evidence that each CMS has a separate vulnerability. For users, the practical issue is whether a service has been secured and restored—not simply whether its application software appears up to date.
The incident also shows why a service may be taken offline before a compromise is established. A shutdown can be a precaution while administrators assess exposure and apply fixes. It should not be read as proof that attackers accessed the service, just as the absence of a reported compromise does not remove the need to patch.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and Patch Guidance
The Dutch government’s October 21 announcement said multiple sites were taken offline as a preventive measure while PHP2Shell risk was being addressed. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws. The announcement reported no signs of active exploitation at that time.
The Dutch National Cyber Security Centre later confirmed patches were available and urged organizations to update. Its guidance said systems that had not been patched should remain offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass its protections. That report concerns observed attempts; it does not establish that the named Dutch government services were compromised.
PHP’s release notes and researcher reports describe differences between deployment setups. Some demonstrated attacks against Apache with mod_php occur before application code runs. PHP-FPM handles certain startup failures differently, but researcher Calif described application-dependent exploitation paths involving PHP-FPM. That distinction means operators should assess their actual runtime and configuration rather than assume a particular PHP setup is unaffected.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
— Dutch government announcement
Which Services Were Exposed
The public announcements cited here do not identify every affected Dutch service, give a full timeline for restoration, or say when each site was patched. The government’s statement that there were no signs of active exploitation reflects its assessment at that time; it is not a guarantee that no attempted access occurred or that later findings could not change the picture.
Cloudflare’s report of attack traffic does not identify successful attacks against the Dutch sites. Nor do demonstrations against CMS deployments establish that a particular organization was vulnerable or breached. Actual exposure depends on the PHP version, vendor package, server configuration and application behavior. The source material does not provide a consolidated count of confirmed compromises.
For organizations relying on hosting providers, it may not be clear from a website dashboard which PHP runtime is serving each site or whether a vendor backport has been installed. Operators need confirmation from the provider or their own system checks rather than inferring patch status from an application update.
Patching and Service Restoration
Operators should verify the PHP runtime and deployment configuration for each exposed service, apply the fixed release or a confirmed vendor backport, and check that the patched runtime is the one actually handling requests. Organizations using hosted services should ask their provider for confirmation. The Dutch cyber centre’s published advice is to keep systems that remain unpatched offline.
The Dutch government has not provided a restoration schedule in the material cited here. The next confirmed developments to watch for are updates from government agencies about services returning online, further guidance from the Dutch National Cyber Security Centre, and any revised assessments of exploitation or compromise. Until then, the reported shutdowns should be understood as precautions, while the scope of affected systems and any later findings remain subject to confirmation.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used in the source material for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says they involve memory-handling failures that can lead to unauthenticated remote code execution.
Were the Dutch government websites hacked?
The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution and reported no signs of active exploitation at the time of its announcement. The cited material does not confirm that those services were compromised.
Does updating WordPress fix PHP2Shell?
No. The vulnerabilities are in the PHP runtime. Updating WordPress or its plugins does not patch PHP itself; operators need to confirm that the software serving their website has received a fixed release or vendor backport.
Which PHP versions include fixes?
The releases listed with fixes are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided source backports for 7.4, 8.0 and 8.1. Users on distribution or extended-support packages should check with their vendor because backported fixes may not be apparent from the version number alone.
Does reported attack traffic mean the Dutch sites were breached?
No. Cloudflare reported observing attack traffic and attempts to alter payloads, but that does not establish successful access to the named Dutch services. The cited government announcement reported no signs of active exploitation at that time.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
