TL;DR
PHP released emergency updates on Oct. 21, 2026, for two critical vulnerabilities that can enable unauthenticated remote code execution in affected web deployments. The Dutch government temporarily took several public websites, including DigiD, offline as a precaution; it did not report confirmed compromises of those sites.
PHP released emergency security updates on Oct. 21, 2026, for two critical flaws that can allow attackers to execute code remotely without logging in, prompting the Dutch government to take several public websites offline as a precaution. The government named Overheid.nl, MijnOverheid.nl and DigiD, but its announcement did not say those services had been compromised.
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, affect PHP’s handling of memory and internal request state. PHP’s security advisories assign both a CVSS v4.0 score of 9.2, rated Critical. The advisories describe code execution risks in PHP installations handling web requests.
PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the affected deployment types. The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using vendor or distribution packages need confirmation that their package addresses both CVEs.
The Dutch shutdown was described as preventive action, not a response to a confirmed breach. Cloudflare separately reported attack attempts against its customers. PHP’s advisories describe demonstrated exploitation on Apache with mod_php; the reported code execution runs as the web worker account and does not by itself establish administrator or root access.
Security briefing · Netherlands · October 2026
How PHP2Shell Brought PHP Security Risks to Light in the Netherlands
Emergency PHP updates addressed two critical flaws that can enable unauthenticated remote code execution. Dutch authorities took several public websites offline as a precaution; the announcement did not report confirmed compromises.
The PHP runtime is the fix
The flaws are in PHP’s engine for handling web requests. Updating WordPress, a theme or a plugin alone does not patch that runtime.
01 · Identify
Find the live runtime
Inventory production, staging and legacy sites. Check the PHP version serving web requests; it may differ from command-line PHP.
02 · Update
Patch both CVEs
Install a fixed release or a vendor-confirmed package. Older branches 7.4, 8.0 and 8.1 received minimal source backports; confirm package coverage for both flaws.
03 · Verify
Confirm the change
Restart or redeploy as needed, then verify live requests reach the patched runtime. Test core functions and preserve logs for review.
How the two flaws work
Both involve PHP’s handling of memory or internal request state. Advisories describe demonstrated exploitation on Apache with mod_php.
CVE-2026-109618 · Memory corruption
Partly initialized request data
An out-of-memory failure can interrupt an operation while internal request data is only partly initialized. Later cleanup may treat invalid data as valid, corrupting memory and potentially enabling code execution.
CVE-2026-109619 · Stale references
Freed memory remains referenced
Internal state can retain references to memory after it has been freed. A later request handled by the same worker may encounter those stale references.
Exposure depends on deployment
PHP lists several web serving setups as affected. The reported exploit evidence and application-dependent paths do not establish identical exposure across every setup.
Deployment types PHP lists as affected. Bar lengths are visual markers only and do not represent measured risk or exploitability.
Patch, verify, investigate
An update closes the known vulnerability. It cannot establish whether a system was accessed before remediation.
- 1Inventory every site. Include production, staging and legacy systems, plus the runtime handling each site’s web requests.
- 2Install a fixed release. Use PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package confirmed to fix both CVEs.
- 3Restart and verify. Complete required redeployment, confirm live traffic reaches the patched runtime, and test core functions.
- 4Review preserved logs. Check for suspicious activity. If patching must wait, assess access restrictions or temporary offline operation with your provider; a WAF is an extra layer, not a replacement for the fix.
From disclosure to response
Calif, OpenAI and Wiz described using AI tools in research that helped identify the flaws.
→PHP maintainers led the fixes and published emergency updates.
→Overheid.nl, MijnOverheid.nl and DigiD were named; no compromise was confirmed.
→Update the runtime, verify it is live, and review relevant activity.
Key questions
The practical takeaways for site owners, administrators and hosting customers.
What are PHP2Shell and the two CVEs?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP memory and request-state flaws that can enable remote code execution in affected web deployments.
Were the Dutch government websites hacked?
The government said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. Its announcement did not confirm that those sites were compromised.
Which PHP versions contain the fixes?
PHP lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. Confirm vendor packages address both CVEs.
Will updating WordPress or a plugin fix the flaws?
No. The vulnerabilities are in the PHP runtime. Update the runtime or install a vendor package that fixes both flaws.
Does code execution mean an attacker gets root access?
Not automatically. The advisory describes execution as the web worker account; this does not by itself establish root or administrator access.
Does applying the patch show whether there was an intrusion?
No. Preserve relevant logs and investigate suspicious activity to assess possible access before remediation.
The PHP Runtime Is the Fix
The flaws affect the PHP engine used to handle web requests, so updating a website’s content management system, themes or plugins alone does not address them. Operators need to identify which PHP runtime serves each site, apply a fixed release or vendor package, and confirm the live web service is using it after any required restart or redeployment.
The potential for remote code execution makes patching urgent for exposed systems. The practical risk differs by deployment and configuration, however, and a critical score does not mean every installation is exploitable in the same way. Authorities’ decision to take public sites offline shows the service disruption that can follow precautionary risk management, even when no compromise has been reported.
Applying an update also cannot establish whether an intrusion happened before the patch. PHP’s guidance and the source material advise operators to preserve relevant logs and review suspicious activity. A web worker’s ability to execute code should not be conflated with control of the underlying server at a higher privilege level.
Products Worth Considering
LG UltraGear 34-inch Curved OLED Gaming Monitor, WQHD 1440p, 240Hz, 0.03ms, 800R
Jackery Explorer 2000 v2 Portable Power Station with Two 200W Solar Panels
Bose Smart Dolby Atmos Soundbar, All-in-One Soundbar for TV, A.I. Dialogue Mode, Voice Control and Amazon Alexa Built-in, Supports Bluetooth
As an affiliate, we earn on qualifying purchases.
How the Two Flaws Work
CVE-2026-109618 involves an out-of-memory failure that can interrupt an operation while internal request data is only partly initialized. Subsequent cleanup may treat invalid data as valid, creating memory corruption that can lead to code execution. CVE-2026-109619 involves internal state retaining references to memory after it has been freed; a later request handled by the same worker may encounter those stale references.
PHP’s advisories report demonstrated exploitation on Apache with mod_php. One advisory says execution occurs with the privileges of the web worker, which does not automatically grant root or administrator access. The source material also describes application-dependent exploitation paths involving PHP-FPM. Different startup and request handling behavior in one setup is not evidence that another deployment is immune.
The disclosure also involved AI-assisted research. Calif, OpenAI and Wiz described using AI tools, including GPT-5.6 Sol and Gemini 4 Argon, in work that helped identify the flaws. PHP maintainers led the fixes and releases; the source material does not suggest that AI tools replaced expert review or deployment work.
“Both vulnerabilities carry a CVSS v4.0 score of 9.2, rated Critical.”
— PHP security advisories
Exposure Depends on Deployment
The Dutch government announcement did not confirm that the offline services had been compromised, and the source material does not establish whether any other specific victim suffered a successful intrusion. Cloudflare reported attack attempts against its customers, but the material provides no confirmed count, time window or comparison baseline for those attempts.
PHP’s advisories describe demonstrated exploitation on mod_php, while other exploitation paths can depend on the application and deployment. The source material does not establish how many internet-facing PHP installations are vulnerable or how many have been patched. It also does not specify when the Dutch sites would return to service.
For older PHP versions, a version number alone may not show whether a vendor has backported a fix. Operators need package-specific confirmation. A patch also does not answer whether a system was accessed before remediation; that requires investigation of relevant logs and activity.
Patch and Verify Live Sites
Operators should inventory production, staging and legacy sites, then check the PHP version actually handling web requests, which may differ from command-line PHP. They should install the fixed release or a vendor-confirmed package, complete any required restart or redeployment, and verify that requests reach the patched runtime.
After updating, site owners should test core functions and review preserved logs for suspicious activity. Managed hosting customers can ask their providers to confirm that both CVEs are addressed. If an update must wait, PHP’s guidance calls for assessing access restrictions or temporary offline operation with a provider; a web application firewall is an additional layer, not a substitute for the software fix.
The Dutch government’s next steps, including the timing of any restoration, were not specified in the source material. Advisories and vendor guidance may change as providers publish package updates, so operators should follow the applicable PHP and vendor notices.
Key Questions
What are PHP2Shell and the two CVEs?
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two PHP memory and request-state flaws that can enable remote code execution in affected web deployments.
Were the Dutch government websites hacked?
The government said Overheid.nl, MijnOverheid.nl and DigiD were taken offline as a precaution. Its announcement did not confirm that those sites were compromised.
Which PHP versions contain the fixes?
PHP lists 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. For vendor-managed or older installations, operators should confirm that the package addresses both CVEs.
Will updating WordPress or a plugin fix the flaws?
No. The vulnerabilities are in the PHP runtime. Updating a site’s plugins or themes does not patch the PHP engine; operators need to update the runtime or install a vendor package that fixes both flaws.
Does code execution mean an attacker gets root access?
Not automatically. The PHP advisory describes execution as the web worker account; the source material says this does not by itself imply administrator or root access.
Source: Thorsten Meyer AI
