🔍 Read the full analysis: Could PHP2Shell Be Connected To Dutch Government Website Outages? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on October 21 as a precaution after PHP disclosed two critical vulnerabilities that can enable remote code execution. The government said it had no signs of active exploitation of those services at the time; attacks observed elsewhere do not establish that the Dutch websites were compromised.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on October 21 as a precaution after PHP released emergency fixes for two critical flaws that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement, so the shutdowns do not confirm that those services were breached.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and referred to together as PHP2Shell, affect PHP installations processing web requests. PHP’s security advisories describe flaws in memory handling and request state: one can leave data improperly initialized after an out-of-memory failure, while the other can leave stale references after memory is freed. Both can create conditions for remote code execution. Each advisory carries a CVSS v4.0 score of 9.2, rated Critical.
PHP published fixes on October 21 for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, though the project provided limited source backports for versions 7.4, 8.0 and 8.1. Organizations using vendor-maintained or extended-support packages need to check with their provider for a fixed release; an older version number alone does not show whether a backport has been applied.
The Dutch National Cyber Security Centre later said patches were available and urged organizations to install them. Its guidance says systems that have not been updated should remain offline as a precaution. PHP’s security team lists web-facing setups including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed among the deployments to assess.
Why Public Services Went Offline
The shutdowns show how a vulnerability in a widely used server-side runtime can affect the availability of public services even when there is no confirmed breach. Taking sites offline can reduce exposure while operators identify affected systems and apply fixes, but it also temporarily limits access to government information and online services.
The risk is not confined to government. Businesses, publishers and other organizations using PHP may face exposure through their web hosting stack. Updating a content-management system or its plugins is not enough if the underlying PHP runtime remains vulnerable. Operators need confirmation that the runtime serving each site has been patched, including where hosting is managed by a third party.
Research teams have reported demonstrations of unauthenticated code execution against some PHP deployments, and Wiz described demonstrations involving WordPress, Drupal and Joomla. Those examples concern the PHP engine and do not mean the three content-management systems each have a separate flaw. PHP’s advisory says demonstrated execution can run as the web worker account; that does not by itself establish administrator or root access.
PHP security vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
PHP Fixes and Dutch Response
The Dutch government’s announcement described taking selected websites offline as preventive action, not as a response to confirmed compromise. It also said many government sites, including Rijksoverheid.nl, do not use PHP and were not affected by these particular vulnerabilities. Cloudflare has separately reported observing attack traffic and attempts to alter payloads to bypass protections. Those observations indicate attempted exploitation, but they do not show that the named Dutch services were targeted successfully or compromised.
Technical exposure can depend on the PHP deployment and its configuration. PHP advisories report demonstrated exploitation on Apache with mod_php. Research by Calif describes application-dependent exploitation paths involving PHP-FPM, while noting that some startup failures are handled differently there. That distinction does not establish that PHP-FPM is immune; operators need to assess the runtime and application they actually use.
The disclosure also involved AI-assisted security research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative; Wiz independently discovered and reported both vulnerabilities. Calif’s account says the work began with generally available models and depended on a researcher directing the investigation with knowledge of PHP’s vulnerability history. PHP maintainers led the fixes and release.
“There were no signs of active exploitation at the time of the statement.”
— Dutch government announcement
web application vulnerability testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Is Known About Compromise
The Dutch government reported no signs of active exploitation when it announced the shutdowns. The supplied reports do not establish whether any of the named websites were compromised, whether attackers attempted to exploit them, or how long the services would remain offline. Cloudflare’s observations of attack attempts are not evidence that those attempts succeeded against Dutch government systems.
Exposure also cannot be determined from the website’s visible software alone. It depends on the PHP runtime, deployment method, configuration and patch status, including any vendor backports. The available information does not identify which individual Dutch systems used vulnerable PHP or confirm that every affected service has been restored after updating.
server security patch management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Organizations running PHP should identify the versions and deployment methods serving their websites, apply a fixed PHP release or a vendor-provided backport, and verify that the patched runtime is the one handling live traffic. Those using managed hosting should ask their provider for confirmation that the underlying PHP runtime has been updated. The Dutch NCSC’s guidance calls for systems that remain unpatched to stay offline.
For Dutch public services, the next practical milestones are confirmation that affected systems have been patched and decisions on when to restore access. The source material does not give a restoration timetable or a final incident assessment. Continued statements from the government and the NCSC should clarify service availability and whether their assessment of any attempted or successful access changes.
web server security monitoring tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP’s advisories say the flaws can create conditions for remote code execution in affected web-facing installations.
Were Dutch government websites hacked?
The Dutch government said it had no signs of active exploitation when it announced that selected sites were being taken offline. The precautionary shutdown does not establish a breach, and the supplied reports do not confirm that the named services were compromised.
Which PHP releases include the fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Users of older or vendor-supported branches should check for their provider’s fixed package or a documented backport rather than relying on the version number alone.
Will updating WordPress or another CMS fix the problem?
No. These vulnerabilities affect the PHP runtime, not just website application code or plugins. A site owner should confirm that the PHP software serving the site has been patched.
Does PHP-FPM avoid the vulnerabilities?
The available research does not establish that PHP-FPM is immune. Calif describes application-dependent exploitation paths involving PHP-FPM, so operators should check their specific setup and apply the relevant fix.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
