TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released emergency updates on October 21 for two critical flaws that can enable unauthenticated remote code execution in web-facing PHP deployments. Dutch officials said several government websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution; they did not report confirmed compromises of those services.
PHP released emergency updates on October 21 for two critical vulnerabilities that can allow attackers to run code remotely without logging in. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD among other websites offline as a precaution, but did not announce that those services had been compromised.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell in the source material, affect PHP installations handling web requests. PHP’s advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the deployments to assess. Both vulnerabilities have a CVSS v4.0 score of 9.2, rated Critical.
PHP said the problems involve request memory and internal state. One flaw can leave request data partly initialized after an out-of-memory failure, allowing cleanup to corrupt memory. The other can leave references to freed memory that a later request in the same worker may use. The advisories describe conditions that can lead to remote code execution; exposure depends on the deployment and configuration.
Fixed releases listed by PHP are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source material says PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older versions or vendor packages need to confirm with their provider that both CVEs are addressed; a version number alone may not show whether a backport is included.
Why Did Dutch Government Websites Go Offline?
PHP released emergency fixes for two critical flaws known as PHP2Shell. Dutch officials took several public services offline as a precaution; no confirmed compromise of those services was reported.
What PHP2Shell puts at risk
Request data left incomplete
After an out-of-memory failure, partly initialized request data can be cleaned up in a way that corrupts memory.
References to freed memory
Internal state may retain references to freed memory, which a later request handled by the same worker may use.
Code execution as the worker
Advisories describe conditions that can enable remote code execution. That does not automatically grant administrator or root access.
Exposure depends on setup. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among deployments to assess. A critical score does not mean every configuration is exploitable in the same way.
Why services went offline
Several sites taken offline
Overheid.nl, MijnOverheid.nl and DigiD were among the websites taken offline as a precaution while officials addressed the risk.
No confirmed compromise reported
The announcement described preventive action. It did not say those services had been breached or targeted.
Separate report: Cloudflare said it observed attack attempts against its customers. That report does not establish that the named Dutch public services were attacked or compromised.
Fixed PHP releases
Minimal source backports were also supplied for PHP 7.4, 8.0 and 8.1, which are outside normal upstream support. For older or vendor-managed packages, ask the provider to confirm both CVEs are fixed; the displayed version alone may not show a backport.
Patch, verify, review
Inventory
Find production, staging and legacy services that handle web requests with PHP.
Patch the runtime
Deploy a fixed PHP release or a vendor package confirmed to address both CVEs.
Restart and verify
Restart or redeploy as required, then verify traffic reaches the patched runtime.
Review logs
Check relevant activity and preserve evidence of anomalies. Patching cannot remove an intrusion that already occurred.
Updating WordPress, a theme or a plugin is not enough. These flaws affect PHP itself. Update the runtime serving the site.
What is still unknown
Return time not stated
No restoration timetable was provided for the Dutch websites.
No intrusion finding described
The source material does not say whether the named sites were targeted or whether an intrusion was detected.
Deployment details matter
The number of exposed PHP installations and the exact vulnerable configurations were not established.
Key questions
Were Dutch government sites confirmed hacked?
No confirmed compromise was reported in the government announcement described here. Officials said services were taken offline as a precaution.
Which PHP versions include the fixes?
PHP lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Confirm backport status with your vendor for older or managed packages.
Does updating WordPress fix PHP2Shell?
No. Update the PHP runtime itself, or use a package or image your provider confirms includes both fixes.
Does remote code execution mean root access?
Not automatically. Code may run as the web worker account; that alone does not establish administrator or root access.
Why PHP Runtime Patching Matters
The flaws affect the PHP engine handling web requests, so updating a site’s content management system, theme or plugin alone does not fix them. Operators need to identify the PHP runtime actually serving each site, apply a fixed release or vendor package, and complete any required restart or redeployment.
PHP says demonstrated attacks on Apache with mod_php can occur before application code runs. The source material also reports that researchers described application-dependent paths involving PHP-FPM. These details mean the risk varies by setup; the critical score does not establish that every deployment is exploitable in the same way. Remote code execution as a web worker also does not by itself mean an attacker has administrator or root access.
The precautionary shutdowns show the potential operational impact of a serious server-side flaw: public services may become unavailable while their operators assess and reduce risk. The Dutch announcement, as described in the source material, indicates preventive action rather than confirmed intrusion at the named sites.
As an affiliate, we earn on qualifying purchases.
Dutch Services Taken Offline
On October 21, the Dutch government said several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution. The source material does not provide a restoration time or describe which technical checks led officials to take each service offline.
The PHP security advisories identify the affected flaws and provide fixed releases. The source material also says Cloudflare separately reported attack attempts against its customers. That report is distinct from the Dutch government’s announcement and does not establish that the named public services were attacked or breached.
“Several websites, including Overheid.nl, MijnOverheid.nl and DigiD, were taken offline as a precaution.”
— Dutch government
As an affiliate, we earn on qualifying purchases.
Exposure and Service Status
The source material does not say whether the Dutch websites were targeted, whether any intrusion was detected, or when the services returned online. It also does not identify how many other PHP installations are exposed or provide enough deployment details to determine which configurations are vulnerable in practice.
PHP’s advisories describe severe outcomes, but the exploit path depends on the runtime and configuration. The source material says vendor packages may include backported fixes, so operators of older or distribution-managed installations should confirm the patch status with their provider instead of relying only on the displayed version.
As an affiliate, we earn on qualifying purchases.
Patch, Verify and Review Logs
Website operators should inventory production, staging and legacy services, check the PHP runtime used for web requests, and deploy the applicable fixed release or vendor-confirmed package. They should then restart or redeploy as required and verify that web traffic reaches the patched runtime. Updating application software alone is not sufficient.
Operators should also review relevant logs for suspicious activity and preserve evidence of anomalies. A patch closes the vulnerable condition but does not remove an intrusion that may already have occurred. The source material does not give a timetable for the Dutch services’ return or announce a follow-up assessment; those details remain pending.
As an affiliate, we earn on qualifying purchases.
Key Questions
Were Dutch government websites confirmed to be hacked?
No confirmed compromise was reported in the government announcement described in the source material. Officials said the named services were taken offline as a precaution.
Which PHP versions include the fixes?
PHP lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. The source material says minimal source backports were also provided for versions 7.4, 8.0 and 8.1; users of vendor packages should confirm both CVEs are fixed.
Does updating WordPress fix PHP2Shell?
No. These flaws affect the PHP runtime. Operators must update PHP itself or use a package or image that their provider confirms includes the fixes.
Does remote code execution mean an attacker gets root access?
Not automatically. The source material says demonstrated execution can run as the web worker account; that does not by itself establish administrator or root access.
Source: Thorsten Meyer AI
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
