TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released fixes for two critical vulnerabilities that can enable unauthenticated remote code execution in affected web deployments. The Dutch government took several websites, including DigiD, offline as a precaution on Oct. 21, but did not report confirmed compromises of those services.
PHP released emergency fixes on Oct. 21 for two critical vulnerabilities that can allow attackers to execute code remotely without logging in, while the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution. The government announcement described preventive shutdowns; it did not confirm that those services had been compromised.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP installations handling web requests, according to PHP’s security advisory. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the deployments that operators should assess. Both vulnerabilities have a CVSS v4.0 score of 9.2, classified as Critical.
PHP describes one flaw as involving interrupted memory handling after an out-of-memory failure, which can leave request data partly initialized. The other involves internal state retaining references to memory after it has been freed. Under vulnerable conditions, the resulting memory corruption or use-after-free can lead to code execution. PHP reports demonstrated exploitation on Apache with mod_php; the advisory says execution occurs as the web worker, which does not by itself mean root or administrator access.
Fixes were released for PHP branches 8.5, 8.4, 8.3 and 8.2 as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, respectively. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older versions or managed hosting need to confirm with their vendor that the deployed package addresses both flaws. Updating a website’s content management system, themes or plugins alone does not patch the PHP runtime.
Security update · October 21, 2026
Could PHP2Shell’s Exposed Flaws Explain Dutch Government Website Outages?
PHP issued emergency fixes for two critical flaws that can enable remote code execution without login. The Dutch government took several public websites offline as a precaution. The announcement did not confirm that those services were compromised.
“The shutdowns show the disruption a serious vulnerability can cause—even before a breach is confirmed.”
What the timeline tells us01 / The incident
Two critical flaws. A precautionary shutdown.
PHP published emergency security updates on October 21, 2026. That day, the Dutch government temporarily took Overheid.nl, MijnOverheid.nl and DigiD offline to reduce exposure while teams assessed risk.
Access paused
The named sites were taken offline as a precaution. The announcement did not say they had been breached.
Attempts reported
Cloudflare reported attack attempts against its customers. The source material does not connect those attempts to Dutch government sites.
Worker-level execution
PHP reported demonstrated execution as the web worker. That does not by itself establish root or administrator access.
02 / How the flaws work
Memory handling can become code execution
The issues affect PHP’s internal handling of memory and request state. Under vulnerable conditions, memory corruption or stale references can give an attacker a path to execute code remotely without logging in.
Interrupted memory handling
An out-of-memory failure can interrupt an operation before request data is fully initialized. Later cleanup may handle invalid or incomplete data as though it were valid.
Stale memory references
Internal state can retain references after the memory it points to has been freed. A later request handled by the same worker may encounter those stale references.
03 / Where to assess
Check the PHP runtime serving requests
PHP lists several web deployment types for operators to assess. A website can have updated application code and still be exposed if its web requests use an unpatched PHP installation.
Update PHP itself
Updating WordPress, themes or plugins does not patch the PHP runtime. Identify the version actually used by the web server, install a fixed release or confirmed vendor package, and restart or redeploy if required.
Confirm the backport
PHP provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Ask vendors and managed hosts to confirm that both flaws are addressed.
04 / Patch map
Fixed releases by PHP branch
Use the fixed release for the branch in service, or obtain confirmation that a vendor package includes both security fixes. A version number alone may not reveal whether a package has backported the patches.
Patch the runtime, then verify which package is serving live web traffic.
05 / Operator response
Patch, verify, then review logs
A disciplined response covers every environment and checks for activity that may have occurred before patching.
Inventory
List production, staging and legacy deployments.
Patch
Install the fixed release or vendor package covering both CVEs.
Verify
Confirm live traffic reaches the patched runtime; restart or redeploy as needed.
Review
Preserve logs and investigate suspicious activity. A patch does not remove an existing intrusion.
06 / Key questions
What we know—and what we don’t
Were the Dutch government sites confirmed hacked?
No confirmed compromise is stated in the source material. The shutdown was described as a precaution.
Does updating WordPress or plugins fix PHP2Shell?
No. The vulnerabilities affect the PHP runtime. Update PHP itself or use a vendor package confirmed to include both fixes.
Are all PHP websites affected in the same way?
No. Exposure varies by deployment, configuration and application. Assess each server rather than assuming a shared exploit path.
Does worker-level execution mean full system control?
No. Execution as a web worker is serious, but it does not by itself establish root or administrator access.
The PHP Runtime Is the Fix
The vulnerabilities put the server-side PHP runtime at the center of the response. A site can have updated application code and still be exposed if its web requests are served by an unpatched PHP installation. Operators need to identify the PHP version actually used by the web server, apply the appropriate fixed package, and complete any required restart or redeployment.
The Dutch shutdowns show how a serious software vulnerability can disrupt access to public services even when a breach has not been confirmed. Taking services offline can reduce exposure while teams assess risk, but it also limits access for people who rely on those sites. PHP’s reported worker-level execution is serious, though it does not establish that an attacker would gain full system control.
Cloudflare separately reported attack attempts against its customers, according to the source material. That indicates attempted activity but does not establish that the Dutch government sites were targeted or successfully accessed. The source also says AI tools assisted researchers in finding the flaws; PHP maintainers handled the fixes and releases.
As an affiliate, we earn on qualifying purchases.
Two Memory Flaws, One Patch Response
The issues concern PHP’s handling of internal memory and state as it processes web requests. In the first, an out-of-memory failure can interrupt an operation before request data is fully initialized; cleanup may then handle invalid data as if it were valid. In the second, internal state can outlast the request memory it refers to, allowing a later request in the same worker to encounter stale references.
Exposure depends on deployment and configuration. PHP reports demonstrated attacks on Apache with mod_php, including paths that can run before application code. The research cited in the source describes different, application-dependent paths for PHP-FPM; the source says its handling of some startup failures does not establish that PHP-FPM is immune. Operators should check each web deployment rather than infer safety from the framework or a single server configuration.
PHP published its fixes on Oct. 21, 2026, and the Dutch government named three public services taken offline as a precaution that day. The source material also notes that advisories can change as investigations develop. Its disclosure snapshot does not establish that every PHP installation is exploitable in the same way.
“The affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.”
— PHP security advisory
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Compromise Status Remains Unknown
The source material does not report whether the Dutch government websites were successfully attacked, how long they remained offline, or when they would return to service. The shutdown announcement was precautionary, and no confirmed compromise of Overheid.nl, MijnOverheid.nl or DigiD is stated there.
It is also not clear how many PHP deployments are exposed or which were reached by attack attempts. Risk varies by runtime, configuration and application. Cloudflare’s report of attempts against its customers does not, on the information provided, identify the affected customers or connect those attempts to Dutch government services.
Operators may use vendor packages with backported fixes, so a version number alone may not show whether a system is protected. The source does not provide a complete list of affected products or a final assessment of exploitation across deployments.
As an affiliate, we earn on qualifying purchases.
Patch, Verify, Then Review Logs
Website operators should inventory production, staging and legacy deployments, then check the PHP runtime handling web requests. They should install the fixed release for their branch or a vendor package confirmed to address both CVEs. Managed-hosting customers should ask their provider to confirm the fix and whether a restart or redeployment is required.
After updating, operators should verify that web traffic reaches the patched runtime and check that site functions work. They should preserve relevant logs and investigate suspicious activity, since applying a patch does not remove an intrusion that may already have occurred. A web application firewall can add protection, but it is not a replacement for the PHP update.
The Dutch government’s next public update on service availability and its review of the affected systems will clarify when access resumes and whether investigators found evidence of intrusion. PHP’s advisories and vendor guidance may also be updated as technical assessments continue.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No confirmed compromise is stated in the source material. The government said the sites were taken offline as a precaution.
Which PHP versions include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for 7.4, 8.0 and 8.1; users of vendor packages should confirm that both CVEs are addressed.
Does updating WordPress or its plugins fix these flaws?
No. These vulnerabilities affect the PHP runtime. Operators need to update PHP itself or deploy a vendor package that includes the fixes.
Do the vulnerabilities affect every PHP website in the same way?
No. PHP lists several web deployment types as at risk, but exposure depends on configuration and application. Operators should assess each deployment rather than assume that all sites share the same exploit path.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
