TL;DR
PHP released emergency fixes on Oct. 21, 2026, for two critical flaws that can enable unauthenticated remote code execution in vulnerable web deployments. The Dutch government took several public websites offline as a precaution; it did not report confirmed compromises of those sites.
PHP released emergency updates on Oct. 21, 2026, for two critical vulnerabilities that could allow attackers to run code remotely without logging in. The Dutch government said it took Overheid.nl, MijnOverheid.nl and DigiD offline as a precaution, but did not say those services had been compromised.
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to in the source material as PHP2Shell, affect PHP’s handling of memory and internal state. PHP’s security advisories assign both flaws a CVSS v4.0 score of 9.2, classified as Critical. The advisories identify web-facing installations as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP’s account of the first flaw says an out-of-memory failure can interrupt an operation before request data is fully initialized. Cleanup can then handle invalid data as if it were valid, creating memory corruption that may lead to code execution. The second flaw can leave internal state pointing to memory that has already been freed; a later request handled by the same worker may use that stale reference. The reported consequence for both is remote code execution without authentication, though exposure depends on deployment and configuration.
The fixes are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The source material says PHP also provided minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Operators using older releases or vendor-maintained packages need to confirm with their supplier that both fixes are included. Updating WordPress, themes or plugins alone does not patch the PHP runtime.
Security briefing · October 21, 2026
What Happened When PHP2Shell Exposed Critical Flaws In Dutch Websites
PHP issued emergency fixes for two critical runtime vulnerabilities. Dutch authorities took several public websites offline as a precaution; the available reporting does not confirm those services were compromised.
01 / The risk
Two memory flaws, one serious outcome
Both advisories describe failures in PHP’s engine. The specific route to exposure depends on the web server, PHP handler, and deployment configuration.
Cleanup after an out-of-memory failure
An interrupted operation can leave request data only partly initialized. Cleanup may treat invalid data as valid, corrupting memory and potentially enabling code execution.
Internal state points to freed memory
A worker may retain a reference after its memory has been freed. A later request handled by that same worker could use the stale reference.
Remote code execution without login
PHP reports unauthenticated remote code execution as the potential consequence in vulnerable setups. Execution would have the PHP worker’s privileges; root or administrator access does not follow automatically.
02 / Exposure
Where operators should look
PHP identified web-facing installations as at risk. The source material reports demonstrated exploitation on Apache with mod_php and describes application-dependent paths involving PHP-FPM.
| Deployment | What the reporting says | Operator takeaway |
|---|---|---|
| Apache + mod_php | PHP reported demonstrated exploitation on this configuration; some attacks may happen before application code runs. | Prioritize inventory, patching, and log review. |
| PHP-FPM | Startup failures may be handled differently, but PHP-FPM is not established as immune; application-dependent paths are described. | Assess the actual application and runtime configuration. |
| Other web-facing handlers | Advisories identify php-cgi, FrankenPHP, and LiteSpeed among potentially at-risk setups. | Confirm exposure against the vendor advisory and package. |
| WordPress and other apps | The flaws are in the PHP runtime, not a specific CMS, theme, or plugin. | Application updates alone do not patch PHP. |
“Both vulnerabilities are rated 9.2 Critical under CVSS v4.0.”
PHP security advisories03 / Fixed releases
Patch the PHP runtime
PHP released emergency updates on October 21, 2026. Confirm that the web server’s runtime—not just the command-line PHP version—is receiving the fix.
Confirm vendor backports
The source material says minimal source backports were provided for PHP 7.4, 8.0, and 8.1, which are outside normal upstream support. Ask the supplier whether both fixes are present, or move to a supported release.
Use layered defenses
A web application firewall may add protection while teams patch. It does not replace updating the runtime, and patching does not remove an intrusion that may already have occurred.
04 / Response
Patch, verify, review
A practical sequence for public-facing, staging, and legacy sites.
Inventory
Identify every public-facing and staging application and the PHP runtime serving it.
Install fixes
Apply a fixed release or a vendor package confirmed to address both CVEs.
Verify live traffic
Restart or redeploy when required, then confirm requests reach the patched runtime.
Review evidence
Check relevant logs and preserve records needed for a security investigation.
05 / Dutch public services
Precautionary shutdown is not proof of compromise
The government reportedly took Overheid.nl, MijnOverheid.nl, and DigiD offline as a precaution while the risk was assessed.
Services taken offline
The shutdown reduced exposure while operators could assess and patch systems, but interrupted access to public services.
No confirmed compromise in the source
The material does not report that these named services were hacked, identify their PHP versions or configurations, or provide a restoration timetable.
Attempts reported elsewhere
Cloudflare separately reported attack attempts against its customers. The material does not connect those attempts to the Dutch services.
AI-assisted research cited
Accounts cited in the source name GPT-5.6 Sol and Gemini 4 Argon among tools used. PHP maintainers led the fixes and releases; the source does not fully detail each organization’s role.
06 / Key questions
What the reporting does—and does not—establish
What are the PHP2Shell vulnerabilities?
Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory handling and internal state. PHP says they can enable unauthenticated remote code execution in vulnerable deployments.
Were DigiD and the other sites hacked?
The government said the sites were taken offline as a precaution. The source material does not report confirmed compromises of DigiD, Overheid.nl, or MijnOverheid.nl.
Will WordPress or plugin updates fix this?
No. The vulnerabilities affect the PHP runtime. Updating WordPress, themes, or plugins alone does not apply the PHP security fixes.
Does successful exploitation mean root access?
Not automatically. The reported code execution may run with the PHP worker’s privileges. Broader impact depends on the affected system and its configuration.
Why the PHP Runtime Matters
PHP powers websites and applications that handle requests from the public, so a flaw in the runtime can affect many services at once. A successful attack could let an unauthenticated remote party execute code with the privileges of the PHP worker. That can put the affected application and its accessible data at risk, but the reported worker-level access does not automatically mean administrator or root access.
The Dutch shutdowns show the operational impact of responding to a serious software risk before an investigation has established whether a particular service was attacked. Taking a site offline can reduce exposure while operators assess and patch systems, but it also interrupts access to public services. The government’s stated precautionary action should not be read as evidence of a breach.
Cloudflare separately reported attack attempts against its customers, according to the source material. That indicates attempted activity, but does not establish that any named Dutch government service was targeted or affected. The practical priority for operators is to identify the PHP runtime actually serving each site, apply a fixed package, and verify that requests reach the updated runtime.
Products Worth Considering
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Samsung 37-inch Odyssey G7 Curved 4K UHD Gaming Monitor (G75F)
LG UltraGear 27G810A-B 27-Inch 4K UHD IPS Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Flaws and Their Fixes
The two advisories describe different memory-management failures. CVE-2026-109618 concerns request processing interrupted by an out-of-memory condition, followed by cleanup of partially initialized data. CVE-2026-109619 concerns state that can retain a reference after the memory it points to has been freed. In each case, the flaw is in PHP’s engine rather than in a particular content-management system or plugin.
PHP reported demonstrated exploitation on Apache configurations using mod_php. The source material says some attacks on that setup can occur before application code runs. PHP-FPM handles certain startup failures differently, but this does not establish that PHP-FPM deployments are immune; the material also describes application-dependent exploitation paths involving PHP-FPM. Deployment details therefore matter when evaluating exposure.
AI-assisted research was part of the discovery process, according to accounts from Calif, OpenAI and Wiz cited in the source material. Those accounts name GPT-5.6 Sol and Gemini 4 Argon among the tools used. PHP maintainers led the fixes and releases. The source does not provide enough detail to independently assess each organization’s role in discovering or validating the flaws.
“Both vulnerabilities are rated 9.2 Critical under CVSS v4.0.”
— PHP security advisories
Exposure and Breach Status
The source material does not establish that Overheid.nl, MijnOverheid.nl or DigiD were compromised, nor does it give a full account of why each service was taken offline or when it would return. It also does not identify the affected PHP version or configuration used by each Dutch service.
PHP’s advisories and the cited research describe possible code-execution paths, but a Critical rating alone cannot show whether a specific installation is exploitable. The source says Cloudflare observed attack attempts against its customers, without providing details that connect those attempts to the Dutch public services. Whether any attacker achieved code execution, and whether any other systems were accessed, remains unclear from the material provided.
Patch, Verify and Review
Website operators should inventory public-facing, staging and legacy applications, then confirm the PHP version used by the web server; it may differ from the command-line version. They should install a fixed release or a vendor package confirmed to address both CVEs, restart or redeploy where required, and verify that live requests reach the patched runtime. Managed-hosting customers should ask their provider to confirm the fix for both vulnerabilities.
Operators should also review relevant logs for suspicious activity and preserve records needed for an investigation. Patching closes the known vulnerability in the updated runtime but does not remove an intrusion that may already have occurred. The source material says web application firewall protections can provide an additional layer while teams patch, but they are not a replacement for the software update. For older PHP branches, the next step is to confirm the vendor’s support and backport status or move to a supported release.
The next public milestones are confirmation that affected services have been restored and further details, if released, on their security assessments. The source material does not give a restoration timetable or say whether additional technical findings will be published.
Key Questions
What are the PHP2Shell vulnerabilities?
They are two PHP flaws, CVE-2026-109618 and CVE-2026-109619, involving memory handling and internal state. PHP says they can lead to unauthenticated remote code execution in vulnerable deployments.
Were DigiD and the other Dutch sites hacked?
The Dutch government said the sites were taken offline as a precaution. The source material does not report confirmed compromises of DigiD, Overheid.nl or MijnOverheid.nl.
Which PHP releases contain the fixes?
The fixed releases listed in the source material are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Operators on older or vendor-supported versions should confirm directly that their package includes fixes for both CVEs.
Will updating WordPress or its plugins fix the flaws?
No. These vulnerabilities affect the PHP runtime. Updating WordPress, themes or plugins alone does not apply the PHP security fixes.
Does a successful attack give an attacker root access?
Not automatically. The source material says execution may occur with the privileges of the PHP worker. The impact beyond that depends on the affected system and its configuration.
Source: Thorsten Meyer AI
