🔍 Read the full analysis: PHP2Shell Puts PHP Flaws In The Spotlight As Dutch Websites Go Offline on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
PHP released emergency fixes on October 21 for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, that can enable remote code execution without authentication. Dutch authorities took several public websites offline as a precaution; they said there were no signs those services had been actively exploited at the time of their announcement.
PHP released emergency security updates on October 21 for two critical flaws that can allow remote code execution without a login, while the Dutch government took several public websites, including Overheid.nl, MijnOverheid.nl and DigiD, offline as a precaution. The government said it had no signs of active exploitation affecting those services when it announced the shutdowns; the vulnerabilities nevertheless put websites running affected PHP configurations at risk.
The vulnerabilities, collectively referred to as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, classified as Critical. The flaws affect PHP installations handling web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the supplied advisory material.
Both issues involve PHP’s handling of internal memory and request state when processing is interrupted. One flaw can leave incomplete data for cleanup to handle after an out-of-memory failure; the other can leave references to memory that has already been freed. The resulting memory corruption or use-after-free conditions can lead to unauthenticated remote code execution. PHP’s advisory says demonstrated exploitation of the out-of-memory flaw ran as the web worker account, which does not by itself mean access to administrator or root privileges.
PHP published fixed releases for its supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source material says PHP also supplied minimal backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using distribution packages or extended support should check with their vendor for a fixed build; version numbers alone may not reveal whether a backport has been applied.
Why PHP Runtime Patching Matters
The flaws sit in the PHP runtime, beneath applications such as WordPress, Drupal and Joomla. Updating a content management system or its plugins does not patch the interpreter executing the site’s code. Website operators therefore need to establish whether the PHP runtime serving each affected site has been updated, rather than relying on an application dashboard to show that software is current.
Research cited in the source material demonstrated unauthenticated code execution on deployments of those three content management systems. The demonstrations illustrate how a flaw in a shared runtime can affect different applications; they do not mean each CMS has a separate vulnerability. Researchers also demonstrated potential disclosure of sensitive process memory, which could expose credentials or tokens even without code execution.
The Dutch shutdowns show the operational cost of responding before exposure can be ruled out. Government services may be temporarily unavailable while operators identify affected systems and apply fixes. Separately, Cloudflare reported observing attack traffic and attempts to alter payloads to bypass protections. That is evidence of attempted exploitation, not proof that the named Dutch services were breached.
As an affiliate, we earn on qualifying purchases.
Dutch Shutdowns and PHP Fixes
The Dutch government’s October 21 announcement described the shutdowns as preventive action and said there were no signs of active exploitation at that time. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these specific flaws. The Dutch National Cyber Security Centre later said patches were available and urged organizations to update; its guidance says systems that have not been patched should remain offline as a precaution.
Technical accounts describe differences among PHP deployment setups. Demonstrated attacks against Apache with mod_php can occur before application code runs. PHP-FPM handles some startup failures differently, but the source material does not establish that it is immune: Calif described application-dependent exploitation paths involving PHP-FPM. Operators must assess the particular runtime, configuration and application rather than assume one setup is safe.
The disclosure also involved security researchers and AI tools. The supplied accounts say Calif identified a critical flaw through OpenAI’s Patch the Planet initiative, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the fixes. Calif said its initial discovery used generally available models and emphasized that the researcher’s knowledge of PHP’s vulnerability history guided the investigation; Wiz described AI assistance with research, exploit development, detection and patch validation. These are attributed accounts of the research process, not a claim that AI acted without human direction.
“The websites were taken offline as a precaution, and there were no signs of active exploitation at the time of the announcement.”
— The Dutch government
web server memory protection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Is Known About Exposure
The Dutch government said it had no signs of active exploitation of the named services when it announced their shutdowns. The supplied material does not establish whether those services were later restored, whether any other affected sites were compromised, or how many systems remain unpatched. Cloudflare’s report of attack attempts does not identify a confirmed breach of the Dutch government websites.
Exposure also depends on the PHP version, configuration, hosting environment and vendor patches in place. PHP-FPM’s differing handling of some failures does not establish immunity, and an older version string may conceal a vendor backport. The source material does not provide a complete inventory of affected systems or a confirmed count of successful attacks.
As an affiliate, we earn on qualifying purchases.
Patch Verification and Service Restoration
Operators should apply the fixed PHP release or obtain a confirmed patched package from their hosting or distribution vendor, then verify which runtime actually serves each website. Where patch status cannot be established, the Dutch NCSC guidance says systems should stay offline as a precaution. Managed-hosting customers may need confirmation from their provider rather than relying on a CMS update or a general service notice.
The next public developments to watch are updates from Dutch authorities on service availability and any change to their assessment of exploitation, alongside advisories from PHP vendors and hosting providers. The supplied material does not give a restoration schedule for the affected Dutch sites, so their return to service remains unconfirmed.
web application security update kit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They involve memory or request-state handling and can lead to remote code execution without authentication.
Were the Dutch government websites confirmed compromised?
No. The Dutch government said it took several sites offline as a precaution and reported no signs of active exploitation at the time of its announcement. Cloudflare’s reported attack attempts do not establish that those sites were breached.
Does updating WordPress or its plugins fix PHP2Shell?
No. The flaws are in the PHP runtime, not a specific website application. Operators must patch the PHP software serving the site, or confirm that their hosting provider has installed a fixed package.
Which PHP releases contain the fixes?
The source material lists PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed releases. It also says minimal backports were provided for 7.4, 8.0 and 8.1; users of vendor-maintained packages should confirm their package’s status with that vendor.
Are PHP-FPM deployments safe from the flaws?
The available accounts do not establish that PHP-FPM is immune. Although it handles some startup failures differently from Apache with mod_php, Calif described application-dependent exploitation paths involving PHP-FPM. Exposure depends on the actual configuration and should be checked against vendor guidance.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
