🔍 Read the full analysis: Dutch Government Site Outages Put PHP2Shell And PHP Flaws In Focus on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took several websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution on 21 October after PHP disclosed two critical vulnerabilities that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement; PHP patches are now available, and the Dutch National Cyber Security Centre urged organizations to update.
The Dutch government took several public websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution on 21 October after PHP disclosed two critical vulnerabilities that can allow unauthenticated remote code execution. The government said its action was preventive and reported no signs of active exploitation at the time of its announcement; PHP released fixes that day.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell in the source material, affect PHP request processing. PHP’s security advisories describe flaws involving memory corruption after an out-of-memory failure and a separate use-after-free condition. Both received a CVSS v4.0 score of 9.2, rated Critical, according to the advisories.
PHP identified web-facing installations as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerabilities can potentially allow remote code execution without a login. Demonstrations cited in the source material include execution as the web worker account; that does not by itself mean an attacker gains administrator or root privileges.
PHP released patched versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided limited source backports for versions 7.4, 8.0 and 8.1. Organizations using distribution or extended-support packages need to check with their provider for a fixed package: a version number alone may not show whether a vendor has backported the fixes.
Cybersecurity · Public Services · 21 October 2026
Dutch Government Site Outages Put PHP2Shell in Focus
Several public websites went offline as a precaution after PHP disclosed two critical flaws that could enable unauthenticated remote code execution. Officials reported no signs of active exploitation when they announced the shutdowns.
Overheid.nl, MijnOverheid.nl and DigiD were among the affected services.
Two PHP request-processing flaws may allow remote code execution without a login.
Attack attempts observed elsewhere do not confirm compromise of Dutch services.
Runtime flaws triggered a public-service pause
The Dutch government took selected websites offline while operators assessed and patched PHP. Rijksoverheid.nl and many other government sites were reported not to use PHP and were not affected by these flaws.
Memory corruption
A flaw following an out-of-memory failure can affect PHP request processing and may open a path to remote code execution.
Use-after-free
A separate memory-safety condition can also create serious impact in vulnerable web-facing PHP deployments.
PHP runtime, not a CMS plugin
Updating WordPress, Drupal or Joomla alone does not fix the PHP software handling site requests. Demonstrations do not mean every CMS deployment is vulnerable in the same way.
Check every web-facing PHP setup
PHP identified several serving configurations as at risk. Actual exposure depends on version, configuration and application behavior.
PHP-FPM · mod_php · php-cgi
Inventory the runtime and configuration behind each live website, including distinct environments and services.
FrankenPHP · LiteSpeed
Web-facing installations using these setups were also identified in PHP’s security guidance.
Worker account access
Exploit demonstrations include execution as the web worker. That does not by itself establish administrator or root access.
Updates are available across supported branches
Apply the appropriate PHP release or vendor-provided security package, then verify that the patched runtime is serving live requests.
| PHP branch | Fixed release | Availability | Operator check |
|---|---|---|---|
| 8.5 | 8.5.12 | ✓ Patch released | Update and verify active runtime |
| 8.4 | 8.4.27 | ✓ Patch released | Update and verify active runtime |
| 8.3 | 8.3.36 | ✓ Patch released | Update and verify active runtime |
| 8.2 | 8.2.35 | ✓ Patch released | Update and verify active runtime |
| 7.4 · 8.0 · 8.1 | Limited source backports | ~ Check provider | Confirm fixed vendor package |
For distribution or extended-support packages, a version number alone may not show whether a vendor has backported the fixes. Ask the package provider to confirm.
From disclosure to service recovery
Authorities and operators described a preventive response. The source material gives no confirmed restoration timetable for the affected sites.
- 01Disclosure
PHP publishes fixes
Security releases address two critical request-processing flaws.
- 02Containment
Sites taken offline
Dutch services pause as a precaution; no active exploitation signs were reported then.
- 03Guidance
NCSC urges updates
Systems not yet updated should remain offline as a precaution, according to its guidance.
- 04Verification
Patch and confirm
Operators check provider packages and confirm the fixed runtime handles requests.
Attempts are not proof of a breach
Keep confirmed statements separate from open questions as services return and investigations continue.
Reported facts
The Dutch government described the shutdown as preventive and said it had no signs of active exploitation when announcing it. Cloudflare separately reported attack traffic and attempts to alter payloads to bypass protections. That does not establish a successful breach of the Dutch sites.
Still unconfirmed
The available source material does not say whether the affected websites have returned online, provide a complete account of each site’s exposure, or establish a confirmed count of successful attacks. Risk varies by PHP version, configuration and application behavior.
Patch the engine behind the site
For managed hosting, ask the provider to confirm the actual PHP package and runtime status for every affected service.
Map each PHP runtime
Find the PHP version, serving mode, host and vendor package used for each website.
Install a fixed package
Use a listed PHP release or a vendor-confirmed backport. Unsupported branches need provider guidance or migration.
Confirm live requests
Check that the patched runtime is active in production; application-code updates alone are insufficient.
Key questions
Were Dutch government websites confirmed hacked?
No confirmed compromise is reported. Officials said the shutdown was precautionary and reported no signs of active exploitation at announcement time.
Which PHP versions include fixes?
8.5.12, 8.4.27, 8.3.36 and 8.2.35. Limited source backports were also provided for 7.4, 8.0 and 8.1; confirm vendor packages with the supplier.
Will a WordPress or plugin update fix PHP2Shell?
No. The vulnerabilities are in the PHP runtime. Update the PHP installation or its vendor-maintained package.
Does reported attack traffic prove a Dutch site was breached?
No. Cloudflare reported attempts, but the source material does not link them to a successful compromise of the Dutch services.
Why the PHP Runtime Needs Attention
The flaws affect the PHP runtime beneath a website, rather than only an individual content-management system or plugin. Updating WordPress, Drupal or Joomla without patching the PHP software serving the site would not address the vulnerabilities. This makes it important for site owners to establish which runtime and configuration their services actually use.
The Dutch shutdown shows how a serious software flaw can prompt precautionary service interruptions even when a compromise has not been confirmed. Such outages can affect access to public information and online government services. For businesses and publishers, the immediate question is whether their hosting provider has patched the PHP runtime behind each affected site, not just whether the site’s application code is current.
The source material also describes successful exploit demonstrations against deployments of common content-management systems, as well as demonstrations of sensitive process-memory disclosure. Those findings indicate possible impacts of the PHP engine vulnerabilities; they do not mean that each named CMS has a separate flaw or that every deployment is exploitable in the same way.
As an affiliate, we earn on qualifying purchases.
How PHP Fixes Reached Operators
The Dutch government said it took the affected websites offline as a preventive measure and reported no signs of active exploitation when it issued its statement. It also said that many other government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws. That distinction matters: the reported disruption involved specific services, not every Dutch government website.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its guidance said systems that have not been updated should remain offline as a precaution. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass its protections. Those observations indicate attempted exploitation, but do not establish a breach of the Dutch services that were taken offline.
The source material credits several research efforts in the discovery and analysis of the flaws, including work by Wiz and Calif. It says PHP maintainers handled the fixes and releases, with support from researchers and infrastructure providers. OpenAI also said a Calif researcher identified a critical flaw with GPT-5.6 Sol through its Patch the Planet initiative. Calif’s account describes the work as expert-directed research using generally available models, rather than an automated discovery independent of researcher input.
As an affiliate, we earn on qualifying purchases.
What Is Not Yet Confirmed
The available statements do not confirm that any of the Dutch sites were compromised. The government’s announcement described preventive action and said it had no signs of active exploitation at that time. Cloudflare’s report of attack attempts does not identify a successful breach of those services. The source material does not establish whether the affected sites have since returned online or provide a full account of their individual exposure.
Risk can also vary by PHP version, server configuration and application behavior. Although PHP listed several web-facing setups as at risk and researchers demonstrated different exploitation paths, the source material does not establish that every installation can be exploited in the same way. It also does not provide a complete list of affected organizations or a confirmed count of successful attacks.
PHP vulnerability scanner software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patching and Service Restoration
Operators should identify the PHP runtime serving each website, apply the appropriate PHP or vendor-provided security update, and verify that the patched runtime is actually handling live requests. Sites that rely on managed hosting need confirmation from their provider; updating application code alone is not a fix. Organizations with unsupported PHP branches should consult their distribution or extended-support vendor about backported packages or move to a supported branch.
For Dutch public services, the source material does not give a timetable for restoration. The next relevant developments are whether affected sites return online, whether authorities report any evidence of compromise, and whether organizations can confirm that their deployed PHP versions contain the fixes. Until those details are available, the shutdowns should be described as precautionary, not as evidence of a breach.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were Dutch government websites confirmed to be hacked?
No confirmed compromise is reported in the source material. The Dutch government said it took several sites offline as a precaution and had no signs of active exploitation when it made its announcement.
Which PHP versions include the fixes?
PHP released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Limited source backports were also provided for versions 7.4, 8.0 and 8.1; users of vendor packages should check with their supplier for a fixed build.
Will updating WordPress or a plugin fix PHP2Shell?
No. The vulnerabilities are in the PHP runtime, so updating a website application or its plugins alone does not patch the software processing requests. The PHP installation or its vendor-maintained package must be updated.
Does the reported attack traffic prove that a Dutch site was breached?
No. Cloudflare reported observing attack attempts, but the source material does not link those observations to a successful compromise of the Dutch websites taken offline.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
