🔍 Read the full analysis: Dutch Websites Go Offline: How PHP2Shell Put PHP Flaws In The Spotlight on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October 2026 as a precaution over two critical PHP vulnerabilities known as PHP2Shell. PHP released fixes the same day; the government said it had no signs of active exploitation at the time of its announcement, while Cloudflare reported seeing attack attempts. The shutdowns do not establish that the named services were compromised.
Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October 2026 as a precaution over two critical vulnerabilities in PHP, the software used to run many websites. PHP released emergency updates for the flaws, called PHP2Shell, which can allow unauthenticated remote code execution in vulnerable configurations; the government said its action was preventive, not a response to confirmed compromise of those services.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories describe two ways request processing can leave internal memory or state in an unsafe condition: an out-of-memory failure can lead to cleanup acting on data that was not fully initialized, while stale references to freed request memory can produce a use-after-free condition. Both issues carry a CVSS v4.0 score of 9.2, rated Critical, and can lead to remote code execution without authentication.
PHP issued fixed releases on 21 October for supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The security team identifies installations handling web requests as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP 8.1 and earlier are outside normal upstream support, although PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1. Operators using vendor-maintained packages should check with their provider because an older version number does not by itself show whether a backport is included.
The Dutch government said several services were taken offline before patches were available and reported no signs of active exploitation at the time of its statement. The National Cyber Security Centre later said patches were available and advised organizations to update; its guidance says systems that remain unpatched should stay offline as a precaution. Cloudflare separately reported observing attack traffic and attempts to alter payloads to evade its protections. That report concerns attempted exploitation generally and does not show that the Dutch services were breached.
Cybersecurity Briefing · Netherlands · 21 October 2026
Dutch Websites Go Offline: How PHP2Shell Put PHP Flaws in the Spotlight
Dutch authorities took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution after two critical PHP vulnerabilities emerged. The shutdown signaled risk management—not confirmation that those services had been breached.
One runtime, two memory failures
PHP2Shell refers to two flaws in PHP request processing. Both can create a path to unauthenticated remote code execution in vulnerable configurations.
Unsafe request state can become an entry point
PHP advisories describe an out-of-memory failure that can leave cleanup acting on incompletely initialized data, and stale references to freed request memory that can trigger a use-after-free. Exploitability depends on runtime, configuration and deployment.
Fixed PHP releases
Install the fixed release for the branch in use, or confirm that a vendor-maintained package includes the backport.
| Supported branch | Fixed release | Action |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update runtime |
| PHP 8.4 | 8.4.27 | Update runtime |
| PHP 8.3 | 8.3.36 | Update runtime |
| PHP 8.2 | 8.2.35 | Update runtime |
Check where PHP runs
Potentially affected setups include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Confirm backports
PHP 8.1 and earlier are outside normal upstream support. Minimal source backports were also provided for 7.4, 8.0 and 8.1.
Ask your provider
An older version number alone does not show whether a vendor backport is present. Get confirmation for the runtime serving your site.
Application updates cannot fix the PHP layer
PHP is the software beneath many websites. A content management system or plugin update does not repair a vulnerable server runtime.
Different sites, same layer
Wiz demonstrated unauthenticated code execution on WordPress, Drupal and Joomla deployments, showing how one runtime flaw can cross application boundaries.
Memory can matter too
Wiz also demonstrated disclosure of sensitive process memory, which could expose credentials or tokens. These were research demonstrations, not confirmed incidents on Dutch services.
No universal immunity
PHP advisories describe demonstrated exploitation on Apache with mod_php. Research also describes application-dependent paths involving PHP-FPM. Setup differences do not prove general immunity.
Code execution as a web worker does not automatically mean administrator or root access.
Impact depends on the server account and surrounding controls.Researchers used AI tools within expert-led vulnerability discovery and validation work.
OpenAI said Calif identified a flaw using GPT-5.6 Sol; Wiz independently reported both flaws.From disclosure to service restoration
The Dutch response moved from precaution to patch guidance. Keeping unpatched systems offline remains the NCSC’s stated precaution.
Risk disclosed
Two critical PHP flaws and emergency fixes were announced on 21 October 2026.
Services paused
Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution before patches were available.
Patch and verify
Apply a fixed release or confirmed backport, then verify the runtime actually serving each site.
Restore safely
Bring services back when fixes are validated and operators can safely resume service.
Separate reported facts from open questions
Shutdowns and attack attempts are evidence of a serious security response. They do not identify successful compromise of the named services.
Precautionary action
The government said the services were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. It said many government sites, including Rijksoverheid.nl, did not use PHP and were not affected by these flaws.
No confirmed breach in the cited accounts
Cloudflare separately observed attack traffic and attempts to alter payloads to evade protections. That report does not identify the Dutch sites as victims. Restoration status, attempt targets and outcomes remain unclear from the cited accounts.
Patch, verify, then restore
Use a short chain of checks to close the runtime gap across self-hosted and managed sites.
Inventory
Identify each PHP runtime and configuration that handles web requests.
Update
Install the branch’s fixed release, or obtain vendor confirmation of a backport.
Validate
Confirm the patched package is active for every site and worker process.
Resume service
Keep unpatched systems offline as advised; restore only after fixes are verified.
Why Runtime Patching Matters
PHP2Shell affects the PHP runtime beneath a website, not just the site’s content-management system or plugins. Updating WordPress, Drupal or Joomla alone does not repair vulnerable PHP software. Website operators need to establish which runtime and configuration serve each site, apply a fixed package, and confirm the patched version is actually in use.
Research by Wiz demonstrated unauthenticated remote code execution on deployments of WordPress, Drupal and Joomla, illustrating that websites built on different applications can be exposed through the same underlying PHP flaw. Wiz also demonstrated disclosure of sensitive process memory, which could expose credentials or tokens even without code execution. These are research demonstrations, not confirmation that every deployment is exploitable or that those outcomes occurred on Dutch government services.
The practical impact extends to hosted websites: customers may not control the server software themselves. They need confirmation from their hosting provider that the PHP runtime serving their sites has been patched. In the Netherlands, the shutdowns also show how a preventive security decision can interrupt access to public services even when officials have not reported a breach.
As an affiliate, we earn on qualifying purchases.
How the Dutch Shutdown Unfolded
The government’s 21 October announcement named Overheid.nl, MijnOverheid.nl and DigiD among the services taken offline as a precaution. It said the shutdown did not reflect confirmed compromise and reported no signs of active exploitation at that time. The government also said many other government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
The vulnerabilities concern how PHP handles internal memory and request state when processing is interrupted. PHP’s advisories describe demonstrated exploitation on Apache with mod_php. One advisory says code execution in that case runs as the web-worker account; that does not automatically grant administrator or root privileges. Technical research also describes application-dependent exploitation paths involving PHP-FPM, so differences between server configurations do not establish general immunity.
The disclosure involved both PHP maintainers and external researchers. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. Calif’s account says its initial discovery used generally available models and was guided by a researcher’s knowledge of PHP’s vulnerability history. Wiz described using AI tools in discovery, exploit development, detection and patch validation. These accounts point to AI-assisted research within expert-led work; they do not change the need for maintainers to issue fixes and operators to deploy them.
“The named services were taken offline as a precaution, and the government reported no signs of active exploitation at the time of its statement.”
— Dutch government announcement
As an affiliate, we earn on qualifying purchases.
What Is Not Yet Confirmed
The available statements do not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised. The government reported no signs of active exploitation when it announced the shutdown, while Cloudflare’s separate observations of attack attempts do not identify those sites as victims. The extent, targets and success of the reported attempts are not specified in the source material.
Exposure also depends on the PHP version, server configuration and deployment. Demonstrations against particular setups show that exploitation is possible, not that every PHP installation is vulnerable in the same way. It remains unclear from the cited accounts which government services have been restored, how many private operators are affected, and whether any incidents beyond attempted attacks have been confirmed.
PHP vulnerability mitigation tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch, Verify and Restore Services
Operators should install the fixed PHP release or a confirmed vendor backport, then verify which runtime is serving each affected site. Organizations relying on managed hosting should ask providers for confirmation rather than assuming that an application or plugin update has addressed the server-level flaw. The Dutch NCSC advises keeping unpatched systems offline as a precaution.
For the public services taken offline, the next steps are to apply and validate fixes, then determine when services can safely return. The government and security agencies may provide further updates on service restoration or incident findings. Until those details are published, the confirmed account remains a precautionary shutdown alongside a critical PHP disclosure—not a confirmed breach of the named Dutch sites.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says they can lead to unauthenticated remote code execution in vulnerable setups.
Were the Dutch government websites hacked?
The government said the services were taken offline as a precaution and reported no signs of active exploitation at the time of its announcement. The information cited here does not confirm that the named websites were compromised.
Which PHP versions contain the fixes?
PHP listed fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. Operators using older or vendor-supported packages should check whether a backport is available and confirmed by their provider.
Will updating WordPress or a plugin fix PHP2Shell?
No. The flaws are in the PHP runtime, so updating a website’s application or plugins alone does not patch them. The runtime serving the website must be updated or covered by a confirmed vendor backport.
Does Cloudflare’s report prove the Dutch sites were attacked?
No. Cloudflare reported observing attack traffic and attempts to bypass protections, but that report does not establish that the named Dutch government services were targeted or compromised.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
