TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
PHP released emergency fixes on Oct. 21 for two critical flaws that can enable unauthenticated remote code execution in affected web deployments. Dutch officials said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution; they did not report confirmed compromises of those sites.
PHP released emergency security updates on Oct. 21 for two critical vulnerabilities that could allow unauthenticated attackers to execute code remotely on affected web deployments. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution; its announcement did not say those services had been compromised.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively described in the source material as PHP2Shell, affect PHP request handling. PHP’s security team lists deployments using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed among those requiring attention. Both vulnerabilities carry a CVSS v4.0 score of 9.2, rated Critical.
The PHP advisories describe separate memory-management problems. An out-of-memory failure can leave request data only partly initialized, after which cleanup may handle invalid data and cause memory corruption. In the second flaw, internal state can retain references to memory that has already been freed, potentially allowing a later request handled by the same worker to use stale data. The advisories say these conditions can lead to code execution; the precise exposure depends on the deployment and configuration.
Fixes were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are outside normal upstream support, although the source material says minimal source backports were provided for versions 7.4, 8.0 and 8.1. Operators using older versions or vendor-managed packages should confirm with their provider that both CVEs are addressed. Updating a content-management system, theme or plugin alone does not patch the PHP runtime.
Security briefing · October 21, 2026
What The PHP2Shell Incident Means For PHP Security And Dutch Government Sites
Two critical PHP flaws triggered emergency fixes and precautionary shutdowns of Dutch public services. The shutdowns signal operational caution; the published account does not confirm that those sites were breached.
01 / What happened
Runtime security became a public-service issue
PHP published emergency updates on October 21 for CVE-2026-109618 and CVE-2026-109619, called PHP2Shell in the source material. Dutch officials said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. Their announcement, as described in the supplied material, did not report confirmed compromise.
Several PHP setups need attention
PHP lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed deployments among those requiring review.
Precaution can mean downtime
Public services may be taken offline while operators assess risk and patch. No restoration timetable was provided in the supplied account.
Reports are not proof of a breach
Cloudflare reported attack attempts against its customers. That does not establish that Dutch government sites were targeted or breached.
02 / Two distinct flaws
Different memory failures, serious possible outcomes
Both vulnerabilities arise in request handling and can lead to memory corruption and code execution. PHP describes separate defects; the precise path and exposure vary by deployment.
Incomplete request data after failure
An out-of-memory failure can leave request data only partly initialized. Later cleanup may treat invalid data as complete, creating a route to memory corruption and potentially remote code execution.
Stale references in worker state
Internal state can retain references to memory that has already been freed. A later request handled by the same worker may use stale data, potentially enabling code execution.
03 / Patch status
Update the PHP runtime that serves web traffic
A CMS, theme or plugin update does not patch PHP itself. Confirm which runtime handles requests: the command-line PHP version can differ from the web-facing version.
PHP 8.1 and earlier are outside normal upstream support. The supplied material says minimal source backports were provided for 7.4, 8.0 and 8.1.
Interpretation: The rating describes vulnerability severity. It does not confirm that a particular site was exposed, attacked successfully or compromised.
04 / Operator response
Patch, verify, then review
A reliable response follows the whole path from inventory to evidence review. A successful patch reduces exposure; it cannot by itself establish whether an earlier intrusion occurred.
Inventory
Find production, staging and legacy sites, plus the PHP runtime serving each one.
Patch
Install a fixed release or provider-confirmed package that covers both CVEs.
Verify
Restart or redeploy as needed, then confirm web requests reach the updated runtime.
Review
Preserve relevant logs and investigate suspicious activity for signs of earlier access.
05 / What depends on deployment
Exposure is shaped by the system around PHP
PHP’s advisories identify affected deployment types, but exploit paths and impact can differ with configuration and application behavior.
Runtime configuration
The source material reports demonstrated attacks on Apache with mod_php. It says PHP-FPM handles some startup failures differently; that does not establish immunity.
Code execution is not root
Execution as a web worker does not automatically provide administrator access. The potential impact depends on permissions and system controls.
Some facts remain unknown
The supplied account does not say how many systems were exposed, whether attackers gained access, or when the Dutch services would return.
Traceability / incident response
From advisory to service assurance
The incident links a vulnerability announcement to runtime changes, verification and public-service decisions.
Quick answers
Key questions
What are the PHP2Shell vulnerabilities?
Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory handling and internal state. PHP says they can enable unauthenticated remote code execution in affected deployments.
Were Dutch government websites hacked?
The supplied account says Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. It does not report confirmed compromise of those services.
Which versions include the fixes?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older or vendor-managed installations, check provider guidance for both CVEs.
Does updating WordPress fix these flaws?
No. The PHP runtime itself must be updated or covered by a vendor-confirmed security package.
Runtime Patching for Public Services
The vulnerabilities put the PHP engine itself at the center of the response. Organizations need to identify which PHP runtime serves each site, apply a fixed release or vendor package, and verify that web requests reach the patched runtime after any required restart or redeployment. A command-line PHP version may differ from the version serving web traffic.
The Dutch shutdowns show the potential operational impact of precautionary response: public services can become unavailable while operators assess risk and apply fixes. The government’s statement, as described in the source material, named the affected sites as taken offline preventively; it did not confirm intrusions. Separately, Cloudflare reported attack attempts against its customers, a report that does not establish that the Dutch sites were targeted or breached.
PHP says demonstrated exploitation on Apache with mod_php can occur before application code runs. The source material also reports that execution as a web worker does not automatically grant administrator or root access. That distinction matters for assessing consequences: remote code execution is serious, while the level of access and resulting impact depend on the affected system’s permissions and configuration.
hardware security keys for online accounts
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Two Flaws Differ
Both vulnerabilities concern how PHP handles memory and internal state when request processing is interrupted or continues across requests. CVE-2026-109618 involves an out-of-memory failure that can leave internal request data incomplete. Later cleanup may treat that data as valid, creating a route to memory corruption and potentially code execution.
CVE-2026-109619 involves state retaining references to memory after it has been freed. A later request in the same worker may use those stale references. The PHP advisories describe these as distinct bugs, even though both concern memory handling and can have remote-code-execution consequences.
PHP published the fixes on Oct. 21, 2026. The source material says researchers at Calif, OpenAI and Wiz described AI-assisted work in finding the flaws, including tools identified as GPT-5.6 Sol and Gemini 4 Argon. PHP maintainers led the fixes and release; the material does not suggest the use of AI replaced expert investigation or deployment work.
network security switches for web hosting
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Exposure Depends on Deployment
The source material does not provide a confirmed account of compromise at Overheid.nl, MijnOverheid.nl or DigiD, nor does it say when those services would return. PHP’s advisories identify affected deployment types, but the specific exploit path and level of exposure can vary with configuration and application behavior.
The source material reports demonstrated attacks on Apache with mod_php and says PHP-FPM handles some startup failures differently. That difference does not establish that PHP-FPM is immune; Calif reportedly described application-dependent paths involving PHP-FPM. It is also unclear from the supplied material how many systems were exposed, whether attackers gained access to any, or how many operators had applied fixes by publication.
Older installations require particular care: an older version number may not show whether a vendor has backported a fix. The source material does not identify every vendor package or its release status. Operators should check the package provider’s security notice and confirm that it covers both CVEs.
web application vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Patch, Verify and Review Logs
Operators should inventory production, staging and legacy sites, determine which PHP runtime handles web requests, and install the fixed release or a vendor-confirmed package addressing both vulnerabilities. Managed-hosting customers should ask their provider to confirm the fix is in place. After patching, teams should complete any required restart or redeployment and verify that requests reach the updated runtime.
Organizations should also preserve relevant logs and review suspicious activity. Applying a patch does not remove an intrusion that may already have occurred. Web application firewall protections can add a layer of defense while teams patch, but the source material describes them as supplementary rather than a replacement for updating PHP. If an update must wait, operators should assess access restrictions or temporary downtime with their provider.
The next public milestones are confirmation of patched deployments and any update from Dutch officials about service availability or investigation findings. The supplied material does not give a restoration timetable or report a confirmed breach of the named government sites.
PHP security patch management tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What are the PHP2Shell vulnerabilities?
They are two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory handling and internal state. PHP says they can enable remote code execution in affected deployments without a login.
Were Dutch government websites hacked?
The supplied source says Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. It does not report confirmed compromises of those services.
Which PHP versions include the fixes?
The listed fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older or vendor-managed installations, check the vendor’s security guidance; a backported fix may not be apparent from the version number alone.
Does updating WordPress fix the PHP vulnerabilities?
No. These flaws affect the PHP runtime. Updating WordPress, its themes or its plugins does not by itself update the engine serving the site.
Does remote code execution mean attackers get root access?
Not automatically. The source material says demonstrated execution ran as the web worker account; the resulting access depends on the system’s permissions and configuration.
Source: Thorsten Meyer AI
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
