🔍 Read the full analysis: What The Dutch Government Website Outage Says About PHP2Shell on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can enable remote code execution. The government said it had no signs of active exploitation of those services at the time; separate reports of attack attempts do not establish that the Dutch sites were breached. Operators need to patch the PHP runtime itself, not just website software.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP released fixes for two critical vulnerabilities, collectively called PHP2Shell, that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation of the affected public services when it announced the shutdown; the action was preventive, not confirmation of a breach.
PHP tracks the flaws as CVE-2026-109618 and CVE-2026-109619. Both concern errors in how the PHP runtime manages memory or request state. PHP’s advisories say the flaws can create memory corruption or use-after-free conditions that may lead to remote code execution. Each has a CVSS v4.0 score of 9.2, rated Critical.
PHP released patched versions on 21 October: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied limited source-code backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using distribution or extended-support packages need to check with their supplier: a version number by itself does not show whether a security backport has been applied.
The Dutch National Cyber Security Centre said patches were available and urged organizations to update. Its guidance says systems that have not been patched should remain offline as a precaution. PHP identifies web-facing installations—including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed—as potentially at risk. Updating a CMS or its plugins does not patch the PHP runtime.
Cybersecurity briefing · 21 October 2026
What The Dutch Government Website Outage Says About PHP2Shell
Three Dutch public services went offline as a precaution after PHP disclosed two critical runtime flaws. The government said it had no signs of active exploitation of those services at the time. The operational lesson: patch the PHP runtime itself, then verify what is serving requests.
Preventive shutdown does not confirm a breach.
Exposure sits below the CMS. Updating WordPress, Drupal or plugins does not fix a vulnerable PHP runtime.
01 / At a glance
What happened—and what it means
On 21 October, the Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline to reduce risk after PHP released fixes. It said there were no signs of active exploitation at the time. The action was precautionary; the supplied reports do not confirm that those sites were breached.
Remote code execution
PHP advisories describe memory corruption and use-after-free conditions that can allow unauthenticated remote code execution.
PHP is not the CMS
A current website dashboard does not show whether the underlying runtime has been patched, especially on managed hosting.
Attempts are not compromise
Cloudflare reported attack traffic and payload changes. That signals attempted exploitation, not a confirmed intrusion into the named Dutch services.
02 / Vulnerability profile
Two flaws. One runtime patching job.
Both issues affect PHP’s handling of memory or request state. PHP identifies web-facing deployments as potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
| Identifier | Issue class | Potential outcome | Severity |
|---|---|---|---|
| CVE-2026-109618 | Request-state / memory handling | Memory corruption may lead to remote code execution | Critical · 9.2 |
| CVE-2026-109619 | Stale internal memory state | Use-after-free may lead to remote code execution | Critical · 9.2 |
Use a fixed upstream release or a verified vendor backport.
03 / Deployment reality
Check the runtime behind the site
Version strings alone can mislead when distributions or extended-support providers backport security fixes. Ask the package supplier whether the affected runtime is patched and confirm that it is the runtime actually serving web requests.
Application paths can vary
Wiz demonstrated unauthenticated RCE in deployments involving WordPress, Drupal and Joomla. These demonstrations concern PHP engine flaws, not separate flaws in each CMS. PHP reported a demonstrated attack running as the web worker account; that alone does not establish administrator or root access.
Exposure is not victim count
Available statements do not establish whether any Dutch government site was compromised, how long services stayed offline, or the full set of affected systems. Public appearance and CMS version cannot establish exposure.
“There were no signs of active exploitation at the time of its statement.”The Dutch government
04 / Response sequence
Patch, verify, then restore
The Dutch National Cyber Security Centre said patches were available and urged organizations to update. Its guidance says unpatched systems should remain offline as a precaution.
Identify every runtime
Inventory PHP versions, application pools and web-facing deployment methods.
Apply the fix
Install a listed PHP release or obtain supplier confirmation of a backport.
Verify serving path
Confirm the patched runtime is the one handling live web requests.
Restore service
Bring services back only after patching and deployment checks are complete.
05 / Key questions
What operators should know
Keep the distinction clear between a vulnerable system, observed attack traffic and a confirmed compromise.
Were the Dutch government websites confirmed hacked?
No. The government said it had no signs of active exploitation when it announced the precautionary shutdown. The supplied information does not confirm compromise of Overheid.nl, MijnOverheid.nl or DigiD.
What is PHP2Shell?
The collective name for CVE-2026-109618 and CVE-2026-109619, two critical PHP runtime flaws that can lead to remote code execution. Each has a CVSS v4.0 score of 9.2.
Does updating WordPress or another CMS fix it?
No. The vulnerabilities are in the PHP runtime beneath the website application. Patch PHP itself or confirm that the hosting provider applied a fixed package or backport.
Which releases contain the fixes?
PHP listed 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Limited source backports were supplied for 7.4, 8.0 and 8.1; verify vendor package status with the supplier.
Does attack traffic prove the Dutch sites were compromised?
No. Cloudflare reported observed traffic and attempts to alter payloads to bypass protections. Those reports do not identify a successful intrusion into the named services.
Can a public version number settle exposure?
No. Risk depends on runtime, deployment method, configuration and vendor backports. Ask the hosting or software supplier to confirm the package status.
Why Runtime Patching Matters
The incident shows why a web service’s PHP runtime and configuration matter independently of its website software. Organizations may have updated WordPress, Drupal or another application and still be running vulnerable PHP underneath it. For managed hosting customers, the relevant question is whether the provider patched the runtime serving each site, not whether the site’s dashboard reports current plugins.
Research by Wiz demonstrated unauthenticated remote code execution in deployments involving WordPress, Drupal and Joomla. Those demonstrations concern the PHP engine flaws, rather than separate vulnerabilities in each content-management system. Wiz also reported demonstrations of sensitive process-memory disclosure, which could expose credentials or tokens even without code execution. PHP says one demonstrated attack ran as the web worker account; that does not, by itself, establish administrator or root access.
Cloudflare has reported observing attack traffic and attempts to alter payloads to bypass its protections. That is evidence of attempted exploitation observed by the provider, not proof that the named Dutch services were attacked successfully. The distinction matters: the Dutch shutdown was announced as a precaution, while the broader reports describe activity against vulnerable systems without identifying a compromise of those government sites.
As an affiliate, we earn on qualifying purchases.
How the Dutch Shutdown Unfolded
The Dutch government announced on 21 October that several services, including Overheid.nl, MijnOverheid.nl and DigiD, had been taken offline to reduce risk. It said there were no signs of active exploitation at the time. The statement also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws.
PHP’s security advisories describe two related failure modes: an out-of-memory interruption can leave request data improperly initialized, while stale internal state can retain references to memory that has already been freed. PHP reported demonstrated exploitation on Apache with mod_php. Technical research also describes application-dependent paths involving PHP-FPM; different handling of some startup failures is not proof that PHP-FPM deployments are immune.
The disclosure also involved AI-assisted security research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative, while Wiz reported independently discovering both vulnerabilities. Calif’s account says its researcher used generally available models and directed the investigation using knowledge of PHP’s vulnerability history. These are accounts from the researchers and companies; PHP’s maintainers issued the fixes.
“There were no signs of active exploitation at the time of its statement.”
— The Dutch government
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The available statements do not establish whether any Dutch government website was compromised, and the government said it had no signs of active exploitation when it announced the shutdown. Cloudflare’s reports of attack attempts do not identify a successful intrusion into those named services. The status of each service after patching, and how long any remained offline, is not specified in the supplied material.
It is also not possible to determine exposure from a site’s public appearance or CMS version alone. Risk depends on the PHP runtime, deployment method, configuration and whether a vendor backport is present. The supplied reports do not provide a complete account of affected Dutch systems or confirmed victim counts. Operators should verify their package status with the relevant hosting or software vendor rather than infer it from a version string.
As an affiliate, we earn on qualifying purchases.
Patch, Verify, Then Restore
Organizations running PHP should apply the fixed release or a vendor-provided backport, then verify that the patched runtime is the one actually serving web requests. The check should cover all relevant deployments, including separate PHP versions or application pools where used. For sites hosted by a third party, operators should ask the provider to confirm which runtime was patched and when.
Services taken offline should remain unavailable until their operators have applied the relevant fix and checked their deployment, in line with NCSC guidance. The Dutch government may provide further information about restoration or its assessment, but no such details are included in the source material. Updates to the CMS alone are not a substitute for patching PHP.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were the Dutch government websites confirmed to be hacked?
No. The government said it had no signs of active exploitation when it announced the precautionary shutdown. The supplied information does not confirm a compromise of Overheid.nl, MijnOverheid.nl or DigiD.
What is PHP2Shell?
PHP2Shell is the collective name used for CVE-2026-109618 and CVE-2026-109619, two critical PHP runtime flaws that can lead to remote code execution. Each carries a CVSS v4.0 score of 9.2.
Does updating WordPress or another CMS fix the problem?
No. The vulnerabilities are in the PHP runtime, below the website application. Operators need to patch PHP itself or confirm that their hosting provider has applied a fixed package or backport.
Which PHP versions contain the fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Limited source backports were also supplied for 7.4, 8.0 and 8.1; users of vendor-supported packages should verify the fix with their supplier.
Does reported attack traffic prove the Dutch sites were compromised?
No. Cloudflare reported observing attack attempts, but those observations do not establish that the named government services were successfully attacked. The Dutch government’s statement characterized its shutdown as preventive.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
