🔍 Read the full analysis: Dutch Government Website Downtime: The PHP2Shell And PHP Flaw Connection on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement; the preventive shutdown does not establish that the affected services were breached.

PHP identified the vulnerabilities as CVE-2026-109618 and CVE-2026-109619, collectively referred to in the source report as PHP2Shell. Both received CVSS v4.0 scores of 9.2. PHP’s advisories identify web-facing installations as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The flaws involve PHP’s handling of memory and internal state when request processing is interrupted. One can leave request data incompletely initialized after an out-of-memory failure, allowing cleanup to handle invalid data; the other can leave references to memory that has already been freed. The resulting memory corruption or use-after-free can lead to remote code execution. PHP says demonstrated exploitation on Apache with mod_php runs as the web worker account, which does not by itself mean administrator or root access.

PHP released patched versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source report says PHP also provided minimal backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. The Dutch National Cyber Security Centre later said patches were available and advised organizations to update; its guidance says systems not yet updated should remain offline as a precaution.

Why Public Services Went Offline

The episode shows how a flaw in a widely used server-side runtime can affect public services even when the vulnerable code is below the website’s own application. The Dutch shutdown was a risk-reduction measure, not a public finding that attackers had entered government systems. For people relying on those websites, precautionary downtime can disrupt access to information and services while operators assess and patch the underlying software.

The immediate distinction for organizations is between fixing an application and fixing the runtime it depends on. Updating WordPress, Drupal or Joomla alone does not patch PHP. Hosting providers and site operators need to establish which PHP runtime serves each site and whether that specific installation has received a fixed package. A control-panel version label may not tell the whole story if a vendor has backported a security fix.

There is also a broader operational concern: security providers reported observing attempted exploitation. Cloudflare said it saw attack traffic and attempts to alter payloads to bypass protections. Those observations indicate attempts, not successful compromise of the named Dutch sites. Operators should treat the vulnerability as serious without turning reports of attack activity into claims of confirmed intrusion.

The PHP Flaws and Patch Releases

The vulnerabilities are in PHP itself, rather than in a particular content-management system. Research cited in the source material demonstrated unauthenticated code execution against WordPress, Drupal and Joomla deployments, as well as possible disclosure of sensitive process memory such as credentials and tokens. These examples show potential consequences of the runtime flaws; they do not mean each CMS has a separate vulnerability or that every deployment is exploitable in the same way.

Exposure depends on the runtime, configuration and request-handling path. The source report says some demonstrated attacks on Apache with mod_php can occur before application code runs. It also notes that PHP-FPM handles some startup failures differently, but that this does not establish immunity: Calif described application-dependent exploitation paths involving PHP-FPM. Operators therefore need to check their actual deployment rather than infer safety from the use of a particular PHP handler.

The report also describes research contributions from Wiz and Calif, alongside PHP maintainers’ work on the fixes. It says AI tools assisted some discovery and research efforts, but Calif’s account stressed the role of an informed researcher directing the investigation. Those details concern how the flaws were studied; the confirmed operational issue remains the need to patch affected PHP runtimes.

What Is Known About Exposure

The public information summarized in the source material does not establish whether any attacker successfully exploited either vulnerability against the Dutch services or another affected organization. The government reported no signs of active exploitation when it announced the shutdown, while Cloudflare’s observations concerned attack attempts more broadly. Those statements address different evidence and should not be treated as contradictory proof of a breach.

It is also unclear from the supplied material when each named Dutch service returned to operation, which specific runtime configurations were involved, and whether all affected operators have completed patching. Risk varies by deployment, and vendor backports can make version numbers alone an unreliable indicator. No complete list of vulnerable or patched services is provided.

Patch Checks and Service Restoration

Operators should confirm the PHP runtime and package serving each public site, apply the relevant fixed release or vendor-supported backport, and verify that patched software is actually handling requests. Organizations using managed hosting need confirmation from their provider; an updated site or plugin does not answer whether its PHP runtime is fixed.

For Dutch public services, the next visible steps are restoration where systems meet the government’s security requirements and further official updates on service status. The supplied material does not give a timetable for that process. Organizations that cannot verify a fix should follow the NCSC guidance to keep affected systems offline while they investigate and patch.

Key Questions

Were the Dutch government websites confirmed to be hacked?

No. The government said it had no signs of active exploitation at the time it announced the precautionary shutdown. Taking sites offline was not confirmation of a compromise.

Which PHP versions include the fixes?

The source report lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. It also says minimal backports were provided for 7.4, 8.0 and 8.1; operators should check their distribution or extended-support vendor for the fixed package.

Does updating WordPress or another CMS fix PHP2Shell?

No. The flaws affect the PHP runtime, not just the website application. Operators need to patch the PHP software serving the site, including through their hosting provider if the provider manages it.

Does using PHP-FPM mean a website is safe?

Not necessarily. The source report says PHP-FPM handles some failure paths differently, but describes application-dependent exploitation paths as well. Exposure depends on the specific runtime and configuration, so operators should apply the relevant fix rather than assume immunity.

What should organizations do if they cannot confirm a patch?

The Dutch NCSC guidance cited in the source says systems that have not been updated should remain offline as a precaution. Operators should confirm patch status with their software vendor or hosting provider and verify the fixed runtime is serving the site.

Source: ThorstenMeyerAI.com