🔍 Read the full analysis: A Look At PHP2Shell, Critical PHP Flaws, And Dutch Website Downtime on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency fixes on October 21 for two critical flaws that can enable unauthenticated remote code execution. The Dutch government took several services, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; it said there were no signs those services had been actively exploited at the time of its announcement.
PHP released emergency security updates on October 21 for two critical vulnerabilities that can allow attackers to execute code remotely without logging in. The Dutch government said it had taken Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time.
The flaws, referred to together as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, categorized as critical. Both vulnerabilities involve failures in how PHP handles internal memory or request state, and can create conditions for remote code execution.
PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. The security team identifies PHP installations that handle web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP 8.1 and earlier are outside normal upstream support, though PHP provided minimal source backports for versions 7.4, 8.0 and 8.1. Users of vendor-maintained packages need to check for their provider’s fixed release.
The Dutch government’s action was described as preventive, not a response to confirmed compromise. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to get around its protections. Those observations show attempted exploitation, but do not establish that the named Dutch sites were breached. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update; its guidance says systems that remain unpatched should stay offline as a precaution.
A Look At PHP2Shell, Critical PHP Flaws, And Dutch Website Downtime
PHP issued emergency fixes for two critical flaws that can allow unauthenticated remote code execution. Dutch authorities temporarily took several public services offline as a precaution, reporting no signs those services had been actively exploited at the time.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
The Dutch governmentWhat happened—and what is known
PHP2Shell is the name used for CVE-2026-109618 and CVE-2026-109619. PHP’s advisories rate each critical at 9.2 and describe conditions that can lead to remote code execution without authentication. A reported attack attempt does not establish a breach at any named Dutch service.
CVE-2026-109618
An out-of-memory failure can interrupt initialization of internal request data. Later cleanup may treat invalid data as valid, causing memory corruption.
CVE-2026-109619
Stale internal state can leave a later request referring to memory that has already been freed, creating a use-after-free condition.
Attempts are not proof of compromise
The government reported no signs of active exploitation of the named services when it announced the shutdown. Cloudflare separately reported attack traffic and attempts to alter payloads.
The PHP runtime is the patch target
Updating WordPress, Drupal or Joomla alone does not fix a flaw in the PHP engine serving requests. Operators need to identify the active runtime on every relevant server and confirm the fix is installed there.
Hosting customers: Ask your provider which PHP runtime is handling requests and whether its package includes the security fixes. An application version or dashboard label may not confirm the active patched runtime.
Runtime-level fixPatch versions and support notes
PHP published fixed releases on October 21. For vendor-maintained packages, confirm the provider’s release or backport status directly; an older-looking version number alone does not show whether a fix is present.
| PHP branch | Fixed release | Operator action |
|---|---|---|
| 8.5 | 8.5.12 | Upgrade and verify the runtime serving requests |
| 8.4 | 8.4.27 | Upgrade and verify the runtime serving requests |
| 8.3 | 8.3.36 | Upgrade and verify the runtime serving requests |
| 8.2 | 8.2.35 | Upgrade and verify the runtime serving requests |
| 7.4, 8.0, 8.1 | Minimal source backports provided | Check vendor-maintained package status |
| 8.1 and earlier | Outside normal upstream support | Confirm a supported, fixed package with your vendor |
The Dutch National Cyber Security Centre advised organizations to update. Systems that remain unpatched should stay offline as a precaution.
NCSC guidanceFrom exposure check to service return
Taking public services offline can reduce exposure while teams investigate and patch, but it also interrupts access. The source material gives no confirmed restoration schedule for the affected Dutch services.
The government said many Dutch sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws. Exposure depends on runtime, version, configuration and deployment.
Scope variesWho contributed to the response
PHP maintainers issued the security fixes. Wiz and Calif reported research into the flaws; their accounts describe research contributions, while the PHP team led the security releases.
“Updating website code or plugins alone does not resolve these vulnerabilities.”
Cloudflare“The initial discovery used generally available models, with the researcher directing the work.”
Calif research accountWiz said AI tools assisted with discovery, exploit development, detection and patch validation.
Wiz research accountOpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Calif emphasized the researcher’s role and knowledge of PHP’s vulnerability history.
Research reportsWhat operators and the public should know
Two PHP vulnerabilities
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. PHP says the flaws can lead to remote code execution without authentication.
No confirmed breach in the cited announcement
The government said it took several websites offline as a precaution and reported no signs of active exploitation of those services at that time. Cloudflare’s separate observations establish attack attempts, not a breach at those sites.
Why PHP Runtime Patching Matters
PHP runs the server-side code behind many websites, so a flaw in the runtime can affect a site even when its application and plugins are current. Updating WordPress, Drupal or Joomla alone does not fix PHP2Shell; the PHP software serving requests must be patched. Researchers at Wiz demonstrated unauthenticated code execution against deployments of those content management systems, illustrating how an engine-level weakness can affect different applications.
For operators, the immediate issue is not just whether a fix exists, but whether the fixed runtime is actually handling traffic on every relevant server. A hosting dashboard or application version does not necessarily show that. Managed-hosting customers may need their provider to confirm which PHP version is active and whether its package includes the security fixes. The consequences can include exposure of application data or credentials; the advisories’ technical impact does not by itself establish administrator or root access.
The temporary shutdown of public services also shows the operational trade-off: taking a site offline can limit exposure while operators assess and patch systems, but it interrupts public access. The government said many of its websites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular flaws.
As an affiliate, we earn on qualifying purchases.
How the Flaws Affect PHP Requests
According to PHP’s advisories, CVE-2026-109618 involves an out-of-memory failure that interrupts an operation before internal request data is fully initialized. Later cleanup can treat invalid data as valid, causing memory corruption. The second flaw, CVE-2026-109619, involves stale internal state: a later request may encounter references to memory that has already been freed, creating a use-after-free condition.
PHP reported demonstrated exploitation on Apache with mod_php. In that configuration, some attacks can occur before application code runs. The out-of-memory advisory says execution would run as the web worker account, which does not automatically grant administrator or root privileges. Researchers at Calif described application-dependent exploitation paths involving PHP-FPM; different behavior during some startup failures does not establish that PHP-FPM is immune.
The response also involved multiple security groups. PHP maintainers issued the fixes, while Wiz and Calif reported research into the flaws. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative. Wiz said its research used AI tools to assist with discovery, exploit development, detection and patch validation. Calif’s account said the initial discovery used generally available models and stressed that the researcher guided the work using knowledge of PHP’s vulnerability history. These accounts describe research contributions; PHP’s maintainers led the security fixes and release.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
— The Dutch government
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The available source material does not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised. The government said there were no signs of active exploitation when it announced the preventive shutdown, while Cloudflare separately reported observing attack attempts. Those statements concern different evidence and should not be treated as proof of a breach at the Dutch services.
It is also not clear from the announcements when every affected Dutch site will return to service, how many organizations have vulnerable deployments, or whether all operators have installed verified fixes. Exposure depends on the PHP runtime, version, configuration and deployment. Organizations using distribution or extended-support packages must confirm whether their vendor has backported the fixes; a version number that appears old does not alone show whether it is patched.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Operators should identify each internet-facing system running PHP, apply the fixed release from PHP or their software vendor, and verify that the patched runtime is the one serving requests. Where patching is not yet complete, the Dutch NCSC says systems should remain offline as a precaution. Website owners using managed hosting should ask providers for confirmation of the affected runtime and the applied fix.
The Dutch government’s next steps are expected to include restoring affected services after its security checks; the source material gives no confirmed restoration schedule. Security teams should also review relevant logs and follow-up guidance from PHP, vendors and national authorities. Any determination about compromise requires evidence from the specific system, not simply the presence of an exposed PHP version.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is a name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says the flaws can lead to remote code execution without authentication.
Were the Dutch government websites hacked?
The government said it took several websites offline as a precaution and reported no signs of active exploitation at the time of its announcement. Cloudflare reported attack attempts separately, but that does not establish a compromise of the named Dutch services.
Which PHP versions include the fixes?
PHP listed fixed releases as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1. Operators using vendor packages should check their provider’s security notice because backported fixes may not be apparent from the version number alone.
Will updating WordPress or its plugins fix the vulnerabilities?
No. The flaws are in the PHP runtime, so updating a website’s application or plugins alone does not address them. The runtime serving the site must receive the relevant security fix.
Does PHP-FPM make a website safe from PHP2Shell?
The supplied research does not establish PHP-FPM as immune. Calif described application-dependent exploitation paths involving PHP-FPM, so operators need to assess their actual runtime, configuration and patched status.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
