🔍 Read the full analysis: Dutch Government Websites Face Downtime As PHP2Shell Exposes PHP Flaws on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement; the shutdown was preventive, not confirmation that the services had been compromised. PHP has since released fixes, and the Dutch National Cyber Security Centre urged organizations to patch affected systems or keep them offline.

The vulnerabilities, grouped under the name PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated Critical. They affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The flaws involve how PHP handles internal memory and request state when processing is interrupted. One concerns an out-of-memory failure that can leave request data incompletely initialized; the other involves internal state retaining references to memory that has been freed. Under affected conditions, those errors can lead to memory corruption or use-after-free and, in some cases, remote code execution. The PHP advisory says demonstrated exploitation can run code as the web worker account, which does not automatically give an attacker administrator or root privileges.

PHP released patched versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although the project provided minimal source backports for versions 7.4, 8.0 and 8.1. Organizations using distribution packages or extended support need to check with their supplier for a fixed package; an older version number alone does not show whether a backport is included.

Why Public Services Went Offline

The shutdown shows how a flaw in a widely used server-side runtime can affect access to public services even when there is no confirmed intrusion. PHP runs beneath website applications, so updating a content management system or its plugins does not patch the PHP engine serving it. Operators need to verify the runtime and configuration for each affected service, including whether a hosting provider has applied a vendor fix.

For the public, temporary outages can interrupt access to government information and online services. For organizations, the advisories describe a potentially serious exposure because the flaws can be reached through web request handling without logging in. The practical risk depends on the PHP deployment and configuration; demonstrations on one setup should not be treated as proof that every PHP-hosted site is exploitable in the same way.

Security provider Cloudflare reported observing attack traffic and attempts to alter payloads to evade its protections. Those observations indicate attempted exploitation, but they do not establish that the named Dutch websites were breached. Keeping attack activity, exposure and confirmed compromise distinct is especially important while incident details remain limited.

PHP Fixes and Dutch Guidance

The Dutch government’s announcement said several services were taken offline before patches were available and that officials had no signs of active exploitation at that point. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular vulnerabilities. A subsequent alert from the Dutch National Cyber Security Centre said patches were available and advised organizations to update; its guidance says systems that remain unpatched should stay offline as a precaution.

Technical research described different conditions across PHP deployment types. The supplied source material says exploitation was demonstrated on Apache with mod_php, including paths that can occur before application code runs. PHP-FPM handles some startup failures differently, but research also describes application-dependent exploitation paths involving PHP-FPM. That means the server setup matters, and a different configuration should not be assumed immune without checking the relevant advisory and vendor guidance.

Researchers also demonstrated impacts against WordPress, Drupal and Joomla deployments. Those demonstrations concern flaws in the PHP runtime, not separate vulnerabilities in each content management system. Separate research described possible disclosure of sensitive process memory, including credentials or tokens, in some conditions without achieving code execution. The reports therefore reinforce the need to patch the runtime itself, not just website software.

“There were no signs of active exploitation at the time of its announcement.”

— The Dutch government

Compromise and Exposure Remain Unconfirmed

The government’s announcement reported no signs of active exploitation of the affected public services at that time, but the supplied material does not provide a later forensic account confirming whether any service was targeted or accessed. The precautionary shutdown is not proof of compromise, and Cloudflare’s reports of attack attempts do not identify the named Dutch sites as victims.

It is also not clear from the available information how many government or private systems were exposed, how quickly all operators applied fixes, or whether any credentials or other data were accessed on other vulnerable installations. Risk varies with the PHP version, web server, configuration and application. Operators using managed hosting need confirmation from their provider that the PHP runtime serving their sites is patched, rather than relying on an updated application dashboard.

Patch Verification and Service Restoration

Organizations running affected PHP versions should apply the appropriate fixed release or obtain a patched package from their operating-system or hosting vendor. They should then verify that the updated runtime is the one actually serving web requests, including across separate servers and environments. The Dutch NCSC’s published advice is to keep systems offline until they are updated.

The next public milestones are further updates from Dutch authorities on the status of the affected services and any subsequent findings about exposure or compromise. PHP operators and hosting providers will also need to confirm patch coverage, particularly where older or vendor-maintained versions are in use. Until such information is released, the confirmed facts are the preventive outage, the availability of PHP fixes and the absence of reported signs of active exploitation in the Dutch government’s initial statement.

Key Questions

Were the Dutch government websites hacked?

The supplied government statement said there were no signs of active exploitation at the time. The websites were taken offline as a precaution; that action does not confirm a breach. The available material does not provide a later forensic conclusion.

Which PHP versions include the fixes?

PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Operators on older or vendor-supported branches should check whether their supplier has issued a patched package or backport.

Does updating WordPress or another CMS fix PHP2Shell?

No. These flaws affect the PHP runtime beneath the website application. Updating WordPress, Drupal, Joomla or their plugins alone does not patch PHP; the runtime must be updated separately.

Are all PHP websites vulnerable in the same way?

No. The advisories identify PHP installations handling web requests as at risk, but exploitation conditions can vary by runtime, server configuration and application. Operators should use the relevant PHP and vendor guidance rather than assume a particular setup is either vulnerable or immune.

Source: ThorstenMeyerAI.com