🔍 Read the full analysis: Dutch Government Website Outages Renew Attention On PHP2Shell And PHP Flaws on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical vulnerabilities that can enable unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement; the shutdowns do not establish that the sites were compromised. PHP issued fixes, and the Dutch National Cyber Security Centre urged organizations to patch or keep unpatched systems offline.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow unauthenticated remote code execution. The government said it had seen no signs of active exploitation at the time of its announcement; the preventive shutdowns are not evidence that those services were breached.
PHP tracked the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, collectively referred to in the source material as PHP2Shell. Both received CVSS v4.0 scores of 9.2. PHP says systems that process web requests may be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The flaws involve PHP’s handling of memory and internal request state when request processing is interrupted. PHP’s advisories describe memory corruption and use-after-free conditions that can lead to remote code execution. Researchers also demonstrated potential disclosure of sensitive process memory, which could expose credentials or tokens. The PHP advisories report demonstrated exploitation on Apache with mod_php; execution as a web worker does not, by itself, mean access to administrator or root privileges.
Fixes were released on 21 October for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1. Organizations using older branches or vendor-maintained packages need to check with their provider: a version number alone may not show whether a backport has been applied. Updating a website’s CMS or plugins does not patch the PHP runtime.
Cybersecurity · Netherlands · 21 October 2026
Dutch Government Website Outages Renew Attention on PHP2Shell and PHP Flaws
Three public services went offline as a precaution after PHP disclosed critical vulnerabilities. The shutdowns drew attention to runtime patching—and do not establish that the sites were compromised.
“No signs of active exploitation” at the time of the announcement.
Dutch government announcement · 21 OctoberKey distinction: Vulnerabilities, observed attack attempts and confirmed intrusions are separate findings.
A precautionary shutdown amid serious risk
The Dutch government took several services offline while the vulnerabilities were being addressed. Its announcement reported no signs of active exploitation at that time.
Offline as a precaution
Overheid.nl, MijnOverheid.nl and DigiD were taken offline on 21 October. The source material gives no confirmed return-to-service schedule.
Not every government site
The government said many sites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
Outage is not proof of breach
The preventive shutdowns do not show that the named services were compromised. Attack attempts and demonstrations also do not prove successful access to a particular target.
A runtime flaw beneath the application
The source material uses “PHP2Shell” for two vulnerabilities in PHP request handling. The risk concerns the server runtime, rather than a separate flaw in each website or CMS.
Critical PHP vulnerability
One of two flaws tracked in the source material as PHP2Shell. Each received a CVSS v4.0 score of 9.2.
Critical PHP vulnerability
The second flaw in the pair. PHP advisories describe memory corruption and use-after-free conditions that can lead to remote code execution.
Unauthenticated code execution
Both flaws can enable remote code execution in affected circumstances. Researchers also demonstrated possible disclosure of sensitive process memory, including credentials or tokens.
PHP runs under many kinds of websites
PHP says systems processing web requests may be affected. The specific runtime path and application setup influence exposure.
| Environment or signal | What the source material says | How to read it |
|---|---|---|
| PHP-FPM | May be affected when processing web requests | Check runtime and deployment |
| Apache with mod_php | PHP advisories report demonstrated exploitation | Relevant demonstrated configuration |
| php-cgi, FrankenPHP, LiteSpeed | Listed among potentially affected request-processing systems | Confirm package and setup |
| WordPress, Drupal, Joomla | Research demonstrations concern the PHP engine beneath these applications | CMS or plugin update alone is insufficient |
| Cloudflare attack traffic | Cloudflare reported attempts and payload changes to evade protections | Evidence of attempts, not target compromise |
Fix the PHP runtime serving requests
PHP released fixes on 21 October. Older branches and vendor-maintained packages require provider-specific confirmation.
Upstream fixed releases
PHP issued patched releases for four maintained branches. Install the applicable package and verify it is the runtime actually handling requests.
Older or vendor-maintained branches
PHP supplied minimal source backports for versions 7.4, 8.0 and 8.1. Hosting providers may maintain packages independently, so a version number alone may not reveal whether the fix is included.
Trace the runtime, apply the fix, verify service
Dutch NCSC guidance urged organizations to patch. Systems that had not been updated should remain offline as a precaution.
Identify
Find the PHP runtime and package serving each public-facing site.
Patch
Install a fixed upstream release or a confirmed vendor backport.
Verify
Confirm the patched runtime is handling requests, not just installed on disk.
Restore carefully
If patch status cannot be confirmed, keep the affected system offline as a precaution.
Keep the evidence in proportion
Vulnerabilities and attack activity warrant action. They do not answer whether a particular service was successfully accessed.
Critical flaws were disclosed
PHP advisories describe conditions that can lead to remote code execution, with fixes released on 21 October.
Attack activity was reported
Cloudflare observed attack traffic and efforts to change payloads. Researchers also demonstrated exploitation in reported configurations.
Compromise of named sites
The available information does not establish whether Overheid.nl, MijnOverheid.nl or DigiD were compromised—or when each service returned online.
The exact PHP configurations used by each named service are not specified in the source material.
It is not clear whether every affected hosting environment has been patched.
No later findings or confirmed restoration schedule are provided here.
From discovery to public guidance
Reports describe AI as part of security research. PHP maintainers issued the fixes, and authorities provided operational guidance.
Researchers report flaws
OpenAI said Calif identified a critical flaw through Patch the Planet; Wiz said it independently found and reported both.
PHP publishes fixes
Maintainers issued updated releases and source backports for older branches.
Authorities advise
The Dutch NCSC urged organizations to update and keep unpatched systems offline.
Operators verify
Service owners and providers confirm patch status and assess deployment-specific exposure.
Why PHP Runtime Patching Matters
The episode shows how a flaw in shared server software can affect public-facing services built on different applications. PHP runs beneath the website or content-management system, so updating WordPress, Drupal or Joomla alone does not address a vulnerability in the runtime. Operators need to establish which PHP environment handles each site and whether that environment has received a fixed package.
The potential impact is serious because the vulnerabilities can be triggered without an account, according to the PHP advisories and researcher demonstrations. But exposure depends on deployment details: the research describes different behavior across configurations, including application-dependent paths involving PHP-FPM. The Dutch shutdowns illustrate a precautionary response to that risk, not confirmation of an intrusion.
For users, outages at government service sites can interrupt access to public information and digital services. For other organizations, the incident is a reminder to obtain clear confirmation from hosting providers about runtime patching rather than relying on a current application dashboard. Cloudflare reported observing attack traffic and attempts to alter payloads to evade protections; those observations indicate attempted exploitation, but do not establish compromise of the named Dutch websites.
As an affiliate, we earn on qualifying purchases.
How the Dutch Shutdowns Unfolded
The Dutch government said on 21 October that several sites had been taken offline as a precaution while the PHP vulnerabilities were being addressed. Its announcement said there were no signs of active exploitation at that time. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws.
The Dutch National Cyber Security Centre later confirmed that patches were available and urged organizations to update. Its guidance said systems that had not been updated should remain offline as a precaution. The sequence matters: the government described preventive shutdowns, while the security advisories and external research described vulnerabilities and observed or demonstrated attack activity. Those are separate facts and do not show that the Dutch services were compromised.
Research groups reported demonstrations against deployments of WordPress, Drupal and Joomla, but those results concern the PHP engine beneath those applications rather than separate flaws in each CMS. The source material also describes AI tools used during security research. OpenAI said Calif identified a critical flaw through its Patch the Planet initiative, while Wiz said it independently discovered and reported both vulnerabilities. PHP maintainers issued the fixes; the available accounts describe AI as part of researchers’ work, not as a replacement for expert review or the patching process.
“The websites were taken offline as a precaution; the announcement reported no signs of active exploitation at that time.”
— Dutch government announcement
web server memory protection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The available information does not establish whether the Dutch websites were ever compromised; the government said it had seen no signs of active exploitation when it announced the shutdowns. Nor does the reported attack traffic establish that any particular target was successfully accessed. Attempts, demonstrations and confirmed intrusions are different findings.
It is also not clear from the source material when each named service returned online, which exact PHP configurations were in use, or whether every affected hosting environment has been patched. The vulnerabilities’ behavior can vary by runtime and application setup, so a general statement that a site uses PHP is not enough to determine its precise exposure. Organizations relying on managed hosting may need direct confirmation from their provider.
PHP vulnerability scanning software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Returns
Organizations should identify the PHP runtime serving each affected website, install a fixed upstream or vendor package, and verify that the patched runtime is actually handling requests. Where patch status cannot be confirmed, the Dutch NCSC guidance says unpatched systems should remain offline as a precaution. Site owners should also distinguish runtime updates from application and plugin updates: both may be necessary for general security, but only a PHP package update addresses these PHP flaws.
For the Dutch services, the source material does not provide a confirmed return-to-service schedule. The next useful updates would clarify whether the sites have been restored, what runtime changes were made, and whether subsequent investigation found evidence of unauthorized access. PHP maintainers and national cyber-security authorities may also issue further guidance as organizations assess deployment-specific exposure.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites hacked?
The Dutch government announcement described precautionary shutdowns and said there were no signs of active exploitation at that time. The available information does not confirm a compromise of Overheid.nl, MijnOverheid.nl or DigiD.
What are PHP2Shell and the related CVEs?
PHP2Shell refers in the source material to two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says they involve memory or internal-state handling and can lead to remote code execution in affected circumstances.
Does updating WordPress or another CMS fix the vulnerabilities?
No. These flaws affect the PHP runtime beneath the website application. Updating a CMS or its plugins alone does not patch PHP; operators must check the runtime package and confirm the hosting provider has applied a fix.
Which PHP releases contain the fixes?
The fixes were released in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1. For distribution or extended-support packages, check the vendor’s fixed release because backports may not be apparent from the version number alone.
Does reported attack traffic mean a successful breach?
No. Cloudflare reported attack traffic and attempts to alter payloads, but that does not prove successful access or compromise of a particular service. The government separately said it had no signs of active exploitation when it announced its shutdowns.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
