🔍 Read the full analysis: How PHP2Shell Put Critical PHP Flaws On The Radar During Dutch Site Outages on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
PHP released emergency fixes on October 21, 2026, for two critical flaws that could allow unauthenticated remote code execution in vulnerable PHP deployments. Dutch authorities temporarily took several public websites offline as a precaution; they said there were no signs those services had been actively exploited at the time of their announcement.
PHP released emergency security updates on October 21 for two critical vulnerabilities, collectively called PHP2Shell, that can allow unauthenticated attackers to execute code remotely. On the same day, the Dutch government said it had taken several public-facing services, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution; its announcement said there were no signs of active exploitation of those services at that time.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, in the Critical category. They involve failures in the PHP runtime’s handling of memory and internal state during interrupted request processing. One can leave request data incompletely initialized after an out-of-memory failure; the other can leave references to memory after it has been freed. Both conditions can lead to memory corruption or use-after-free behavior and, under affected conditions, remote code execution.
PHP identifies web-request installations as potentially exposed, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The advisories describe demonstrated exploitation on Apache with mod_php. The out-of-memory advisory says execution occurs as the web worker account, which does not by itself mean an attacker gains administrator or root privileges. Research cited by the source material also describes application-dependent exploitation paths involving PHP-FPM, so operators should not treat a different deployment setup as proof of safety.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, though PHP provided minimal source backports for versions 7.4, 8.0 and 8.1. Organizations relying on distribution or extended-support packages need to check with their vendor for a fixed build: a version number that appears older does not establish whether a backport has been applied.
Security briefing / October 21, 2026
How PHP2Shell Put Critical PHP Flaws on the Radar During Dutch Site Outages
Two critical PHP runtime vulnerabilities prompted emergency patches and precautionary shutdowns of several Dutch public services. The incident highlights the need to patch the software that handles web requests—and to distinguish attack attempts from confirmed compromise.
01 / The vulnerabilities
What PHP2Shell means
PHP2Shell is the collective name for CVE-2026-109618 and CVE-2026-109619. Under affected conditions, each can allow an unauthenticated attacker to execute code remotely through vulnerable PHP deployments.
Incomplete request data
An out-of-memory failure during interrupted request processing can leave request data incompletely initialized, creating a path to memory corruption.
References after release
A separate failure can leave references to memory after it has been freed, producing use-after-free behavior and potential code execution.
Remote code execution
Demonstrated scenarios include Apache with mod_php. Execution as a web worker account does not by itself mean administrator or root access.
Interrupted request
Request processing encounters an out-of-memory condition or related state failure.
Unsafe memory state
Data may remain uninitialized, or a reference may point to freed memory.
Corruption risk
The resulting behavior can lead to memory corruption or a use-after-free.
Potential execution
Under affected conditions, an unauthenticated attacker may execute code remotely.
02 / Exposure surface
Patch the runtime beneath the site
These flaws affect PHP itself, the runtime that processes requests. Updating a CMS or its plugins does not patch the PHP engine serving the site.
Application updates are not enough
WordPress, Drupal, and Joomla sites can depend on the same vulnerable runtime. Reports describe demonstrations involving these CMS platforms, but that does not make each CMS a separate vulnerability.
Exposure depends on deployment and configuration. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed are among the web-request installations PHP identifies as potentially exposed. Research also describes application-dependent paths involving PHP-FPM.
03 / Response timeline
From disclosure to service decisions
Maintainers, researchers, authorities, and infrastructure providers each contributed different parts of the response. Reports of attack traffic describe attempts, not proof that the named Dutch services were breached.
Research reported
OpenAI said Calif identified a critical flaw through Patch the Planet; Wiz reported independently finding and reporting both flaws.
PHP patches released
Emergency security updates addressed both critical vulnerabilities on October 21, 2026.
Dutch sites taken offline
Overheid.nl, MijnOverheid.nl, and DigiD were among the services taken offline as a precaution.
Guidance and monitoring
The Dutch NCSC urged updates and advised systems that remain unpatched to stay offline.
04 / What is known
Outage is not confirmation of compromise
The Dutch government described its action as preventive and said it had no signs of active exploitation of the affected public services when it made the announcement. The available source material does not establish later compromise status, individual restoration times, or outage duration.
“The websites were taken offline as a precaution.”
Dutch government announcementAttack traffic and attempts to alter payloads were observed.
Cloudflare report / attempts are not confirmed breachesResearch accounts describe human direction and prior knowledge in the discovery process.
Calif research account / company statements05 / Operator checklist
Verify the fix is serving traffic
A version string alone may not tell the full story. Distribution and extended-support packages can carry backported fixes, so confirm patch status with the vendor that supplies the runtime.
- ✓Inventory exposed runtimes. Find every PHP deployment that handles web requests.
- ✓Apply a verified fix. Upstream fixed releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- ✓Confirm vendor backports. PHP 8.1 and earlier are outside normal upstream support; minimal source backports were provided for 7.4, 8.0, and 8.1.
- ✓Check the active runtime. Verify the patched build is actually handling traffic across every relevant service.
- ✓Keep unpatched systems offline. Follow the Dutch NCSC precautionary guidance until a fix is applied.
Why Runtime Patching Matters
PHP2Shell affects the runtime that processes website requests, not just the content-management system or application code running on top of it. Updating WordPress, Drupal or Joomla plugins alone does not patch the PHP engine. Cloudflare’s remediation guidance makes that distinction, while Wiz reported demonstrations of unauthenticated code execution against deployments using those content-management systems. These examples show how a flaw in shared runtime software can affect many kinds of websites without being a separate vulnerability in each CMS.
For organizations using managed hosting, the immediate question is whether the provider has patched the PHP version serving each site. For those running their own infrastructure, administrators need to identify every exposed PHP deployment, install a vendor-supported fix, and confirm that the patched runtime is actually handling traffic. The Dutch shutdowns show the service impact of precautionary security decisions: taking public services offline can reduce exposure, but can also interrupt access to government information and services.
The incident also drew attention to AI-assisted vulnerability research. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, and Wiz reported independently discovering and reporting both vulnerabilities. Calif’s account describes the researcher’s direction and knowledge of PHP’s vulnerability history as part of the process. These accounts are research and company statements; they do not establish that AI systems acted independently or that automated discovery was the sole cause of the findings.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and PHP Fixes
The Dutch government said on October 21 that several websites had been taken offline as a precaution while the vulnerabilities were being addressed. Its announcement characterized the action as preventive, not as a response to confirmed compromise of Overheid.nl, MijnOverheid.nl or DigiD. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to update. Its published guidance says systems that have not been updated should remain offline as a precaution. Separately, Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass its protections. That account concerns attempted exploitation; it does not confirm a compromise of the named Dutch services.
The PHP release and researcher disclosures point to separate elements of the response: maintainers issued the fixes, researchers reported findings and demonstrations, and infrastructure providers shared threat observations and guidance. For website operators, the central technical distinction is between patching application software and patching the PHP runtime beneath it.
“The websites were taken offline as a precaution.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
Exposure and Compromise Status
The Dutch government’s statement said it had no signs of active exploitation of the affected public services when it announced their precautionary shutdown. The available source material does not establish whether any of those services were later compromised, when each returned to service, or how long individual outages lasted. Cloudflare’s observations of attack attempts do not resolve those questions.
Exposure can also depend on how a PHP deployment is configured and which software handles requests. Although PHP and researchers describe vulnerable conditions and demonstrated scenarios, the material does not provide a complete inventory of affected sites or establish that every PHP installation can be exploited in the same way. Organizations must confirm their own runtime version and vendor patch status rather than infer exposure from the website’s application version alone.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Returns
Operators should identify PHP runtimes serving web requests, apply the fixed release or a verified vendor backport, and confirm the patched software is active on every relevant service. Organizations unable to update should follow the Dutch NCSC’s advice to keep affected systems offline as a precaution. Managed-hosting customers should ask their providers directly whether the runtime serving their sites has been patched.
Authorities and service operators will need to determine when it is safe to restore any sites taken offline and provide updated information about availability. The source material does not give a restoration timetable. Threat reports may also develop as providers and researchers continue monitoring attempts, but attempted attacks should not be reported as confirmed breaches without evidence.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the collective name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under affected conditions, they can lead to unauthenticated remote code execution.
Were Dutch government websites confirmed to be hacked?
The Dutch government said the named services were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. Cloudflare reported attempted attacks, but that does not confirm a breach of those sites.
Does updating WordPress fix the vulnerabilities?
No. The flaws affect the PHP runtime, so updating WordPress, its themes or plugins alone does not apply the PHP security fix. Operators need to confirm that the PHP software serving the site has been patched.
Which PHP versions contain the fixes?
The releases listed as fixed are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organizations using older or vendor-maintained versions should check whether their provider has supplied a backported fix.
Does using PHP-FPM mean a site is unaffected?
No. The source material describes different behavior and application-dependent exploitation paths across configurations. PHP-FPM should not be treated as immune; operators need to check their exact deployment and apply the appropriate fix.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
