TL;DR
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
PHP released emergency fixes on 21 October 2026 for two critical vulnerabilities that can allow unauthenticated remote code execution in affected PHP deployments. Dutch officials said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution; they did not report confirmed compromises of those services.
PHP released emergency security updates on 21 October for two critical flaws that can let attackers execute code remotely without logging in, as the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. The government announcement described preventive shutdowns, not confirmed compromises of those services.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, affect PHP installations handling web requests. PHP’s security advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the deployment types at risk. Both flaws have a CVSS v4.0 score of 9.2, rated Critical.
PHP’s advisories describe two memory-management problems. One can arise when an out-of-memory failure interrupts an operation, leaving request data partly initialized; cleanup may then handle invalid data as valid. The other involves internal state retaining references to memory that has already been freed, allowing a later request in the same worker to encounter stale data. Both conditions can lead to memory corruption and remote code execution, according to the advisories.
The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older or vendor-maintained packages need to confirm with their provider that both CVEs are addressed; a version number alone may not reveal a backported fix.
PHP2Shell Raises Security Concerns As Dutch Government Websites Go Offline
PHP issued emergency fixes for two critical vulnerabilities that can enable unauthenticated remote code execution. Dutch officials took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; they did not report confirmed compromises of those services.
Memory flaws can open a path to code execution
PHP’s advisories describe two memory-management problems. In affected web deployments, either may lead to memory corruption and remote code execution without a user login.
Partly initialized request data
An out-of-memory failure can interrupt an operation. Cleanup may then treat invalid or incomplete request data as valid, creating a memory-safety risk.
Stale memory references
Internal state can retain references to memory that has already been freed. A later request handled by the same worker may encounter that stale data.
Patch the runtime, then check what it is serving
Updating WordPress, a theme or a plugin does not fix a PHP engine flaw. The web-facing runtime must be updated, and operators should confirm traffic reaches the patched build.
Inventory
Find production, staging and older applications that handle web requests.
Identify runtime
Check the PHP version serving web traffic; it may differ from command-line PHP.
Patch and restart
Install a fixed release or vendor-confirmed package, then restart or redeploy.
Verify and review
Confirm the patched runtime is active, test site functions and review logs for suspicious activity.
Updates cover four maintained branches
PHP published security updates on 21 October 2026. Operators using distribution packages, managed hosting or extended support should confirm that both CVEs are covered.
Risk depends on the web configuration
PHP lists multiple request-handling deployments as in scope. The advisory does not establish that every installation can be exploited through the same path.
Service status and compromise are separate questions
The available announcements describe precautionary shutdowns. They do not provide enough information to infer a breach, identify targets or determine each service’s return time.
Return timing not stated
The material does not say how long each Dutch service was unavailable or when it would return.
No confirmed breach reported
The government announcement cited preventive shutdowns and did not report confirmed compromises of these services.
Attempts are not proof of impact
Cloudflare reported attack attempts against its customers. That does not establish successful exploitation or connect activity to the Dutch shutdowns.
What operators and users should know
What is PHP2Shell?
A collective name for CVE-2026-109618 and CVE-2026-109619, two PHP memory-management flaws that can lead to unauthenticated remote code execution in affected web deployments.
Were the Dutch websites hacked?
The government said the services were taken offline as a precaution. The announcement did not report confirmed compromises.
Will updating WordPress fix it?
No. The vulnerabilities affect the PHP runtime. Update PHP itself or deploy a vendor package that includes both security fixes.
What should happen after patching?
Verify the web-facing runtime is patched, check site functions and review relevant logs. An update reduces future exposure but cannot establish whether an earlier intrusion occurred.
Public Services Face Runtime Risk
The incident puts the PHP runtime itself at the center of the response. Updating WordPress, themes or plugins does not patch these engine vulnerabilities; operators need to update PHP or deploy a vendor package or image that includes the fixes. They also need to confirm that web traffic reaches the patched runtime, which may differ from the PHP version available on the command line.
For people relying on the Dutch services, precautionary shutdowns can interrupt access to government information and online services. For operators more broadly, the advisories indicate potential code execution under the web worker’s account. PHP’s materials do not say that this automatically grants administrator or root access, and the practical exposure depends on deployment and configuration.
Cloudflare separately reported attack attempts against its customers. That report indicates attempted activity, but does not establish that the Dutch websites were targeted or compromised. Patching reduces exposure going forward; it does not establish whether an intrusion occurred before the update, so operators are advised to review relevant logs and investigate suspicious activity.
As an affiliate, we earn on qualifying purchases.
Fixes Span Supported PHP Branches
The PHP security team published fixes on 21 October 2026, with updates for four current branches and limited source backports for three older versions. Organizations that rely on distribution packages or extended support should follow the package vendor’s guidance. PHP says installations handling web requests are in scope, while researchers describe differences in how deployment configurations may be affected.
The source material also says researchers used AI-assisted methods to help identify the flaws, naming Calif, OpenAI and Wiz and listing GPT-5.6 Sol and Gemini 4 Argon among the tools. PHP maintainers led the fixes and release; the available account does not attribute the patching or release process to AI tools. The source material does not provide independent research papers or further detail on how each tool contributed.
“The websites were taken offline as a precaution.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
Exposure and Service Status Vary
The available announcements do not say whether any of the Dutch websites were compromised, how long each service was unavailable, or when it would return. They also do not identify the specific PHP configurations those services used. PHP and researcher materials describe deployment-dependent exposure, so the advisory alone does not establish that every listed installation can be exploited through the same path.
Cloudflare’s report of attack attempts against customers does not establish successful exploitation or connect those attempts to the Dutch shutdowns. The source material gives no details on the targets, outcomes or timing of those attempts. Organizations still need to determine whether their own systems were exposed and whether suspicious activity occurred before patching.
As an affiliate, we earn on qualifying purchases.
Operators Must Patch and Verify
Website operators should inventory production, staging and older applications, identify the PHP runtime serving web requests, and apply the fixed release or a vendor-confirmed package. They should complete any required restart or redeployment, then check that requests reach the patched runtime and that site functions work. Managed hosting customers can ask providers to confirm that both CVEs are covered.
Operators should also preserve relevant logs and review anomalies, since applying an update does not remove an intrusion that may have happened earlier. PHP’s advisory remains the primary source for release guidance; service operators and authorities will need to provide further updates on the Dutch websites’ availability and any findings about compromise. The source material does not give a schedule for those updates.
remote code execution prevention software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP memory-management flaws that can lead to unauthenticated remote code execution in affected web deployments.
Were the Dutch government websites hacked?
The government said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. The announcement did not report confirmed compromises of those services.
Which PHP versions contain the fixes?
PHP listed 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. Source backports were also provided for 7.4, 8.0 and 8.1; operators using vendor packages should confirm that both CVEs are addressed.
Will updating WordPress fix PHP2Shell?
No. These flaws affect the PHP runtime, so operators need to update PHP itself or deploy a vendor package that includes the security fixes.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
