🔍 Read the full analysis: The PHP2Shell Issue Behind Concerns Over Dutch Government Website Outages on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October 2026 as a precaution after PHP disclosed two critical vulnerabilities, known together as PHP2Shell. Officials said they had no signs of active exploitation at the time, and the shutdown was not evidence that those services had been compromised. PHP issued fixes, and the Dutch National Cyber Security Centre urged organizations to patch or keep affected systems offline.
The Dutch government took Overheid.nl, MijnOverheid.nl and DigiD offline on 21 October as a precaution after PHP disclosed two critical flaws that can allow unauthenticated remote code execution. The government said it had no signs of active exploitation at the time of its announcement; the shutdowns do not establish that the named services were breached.
The vulnerabilities, grouped under the name PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s security advisories assign each a CVSS v4.0 score of 9.2, rated critical. Both relate to memory or internal state during interrupted request processing, and can potentially allow an attacker to run code on a vulnerable server without logging in.
PHP released patched versions on 21 October for its supported branches: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also supplied minimal source backports for versions 7.4, 8.0 and 8.1, which are outside normal upstream support. Organizations using operating-system distributions or extended-support providers should check for the vendor’s fixed package: a version number by itself may not show whether a backport has been applied.
The affected setups include PHP handling web requests through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, according to the PHP advisory. Researchers have demonstrated exploitation on Apache with mod_php; that does not mean every PHP deployment is equally exposed. An out-of-memory flaw can result in code running as the web worker account, which does not automatically grant administrator or root privileges.
Cybersecurity · Netherlands · 21 October 2026
The PHP2Shell Issue Behind Concerns Over Dutch Government Website Outages
Critical flaws in PHP prompted precautionary shutdowns of Overheid.nl, MijnOverheid.nl and DigiD while fixes became available. The reported outage was not proof those services had been breached.
A precautionary outage, not a breach finding
The Dutch government took several public services offline on 21 October after PHP disclosed two critical vulnerabilities. The action reduced exposure while operators assessed and updated affected systems.
Three services taken offline
Overheid.nl, MijnOverheid.nl and DigiD were named in the preventive response. The announcement did not establish that any had been compromised.
Unauthenticated code execution
Under certain conditions, the flaws may let an attacker run code on a vulnerable server without logging in.
Runtime-level exposure
The issue affects PHP itself. Updating WordPress, Drupal, Joomla or their plugins alone does not patch the PHP runtime.
One of two PHP2Shell vulnerabilities. PHP’s advisory rates it critical under CVSS v4.0.
Both flaws concern memory or internal state during interrupted request processing.
Attempts, demonstrations and compromise are different claims
Cloudflare reported seeing attack traffic and attempts to alter payloads to bypass its protections. Researchers demonstrated possible impacts in particular setups. Neither finding confirms that the named Dutch services were successfully attacked.
Flaw disclosed
PHP published advisories for two critical vulnerabilities.
Attempts observed
Cloudflare reported attack traffic and payload changes.
Impact demonstrated
Research showed possible outcomes in specific deployments.
Service status unclear
Supplied reports do not confirm compromise or restoration timing.
“The websites were taken offline as a precaution.”
Officials reported no signs of active exploitation at the time of their announcement.Attack traffic included attempts to change payloads.
Observed attempts show activity, not successful access to the named Dutch services.Verify the PHP runtime serving each site
PHP released fixes on 21 October for supported branches. Operating-system distributions and extended-support providers may deliver fixes as backports, so a version number alone may not tell the full story.
| PHP branch | Fixed release | Operator action |
|---|---|---|
| 8.5 | 8.5.12 | Upgrade or verify vendor package |
| 8.4 | 8.4.27 | Upgrade or verify vendor package |
| 8.3 | 8.3.36 | Upgrade or verify vendor package |
| 8.2 | 8.2.35 | Upgrade or verify vendor package |
| 7.4, 8.0, 8.1 | Minimal source backports supplied | Check distribution or extended-support advisory |
Multiple PHP setups
PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are listed in the PHP advisory. Exposure varies by version and configuration.
Code may run as the web worker
An out-of-memory flaw can result in code running with the web worker account. That does not automatically grant administrator or root privileges.
Patch, verify, then restore access
The Dutch National Cyber Security Centre advised organizations to update and said unpatched systems should remain offline as a precaution. Managed-hosting customers should confirm that the provider updated the runtime actually serving their site.
Identify runtime
Check every PHP environment and request handler in use.
Apply verified fix
Install PHP’s fixed release or the vendor’s patched backport.
Confirm serving version
Verify the live runtime, not just the application or plugin state.
Restore service
Return online after patch status and operational checks are confirmed.
One flaw, different deployment conditions
Researchers demonstrated exploitation on Apache with mod_php, but that does not mean every PHP deployment is equally exposed. The available information does not specify every affected Dutch configuration or provide a timeline for all services’ return.
What the reports establish
What is PHP2Shell?
A shared name for CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution under certain conditions.
Were the Dutch websites hacked?
The government described the shutdowns as precautionary and reported no signs of active exploitation at the time. The supplied information does not confirm compromise.
Which PHP versions include fixes?
8.5.12, 8.4.27, 8.3.36 and 8.2.35. Check vendor advisories for backports to older branches.
Will a WordPress update fix PHP2Shell?
No. The issue is in the PHP runtime beneath the application. Verify the runtime update with the hosting provider or systems team.
Does observed attack traffic prove a breach?
No. Cloudflare reported attempts, but that does not establish successful exploitation of the named Dutch services.
What remains unknown?
The reports do not establish the status of every affected service, outage duration, exact configurations or confirmed successful exploitation elsewhere.
Why Public Websites Went Offline
The incident shows why the PHP runtime itself matters to website security, not just the content management system or its plugins. Updating WordPress, Drupal or Joomla does not fix a flaw in the underlying PHP software. Hosting providers and service operators need to verify that the runtime serving each site has received the appropriate fix.
For people relying on public services, precautionary outages can interrupt access even when there is no confirmed compromise. The government’s action was described as preventive, while a separate report of attack attempts does not establish that those Dutch services were affected. Keeping those distinctions clear helps explain both the service disruption and what is known about risk.
Products Worth Considering
LG UltraGear 34G600A-B 34-Inch Curved WQHD Gaming Monitor, 160Hz
Samsung 27-inch Odyssey OLED G6 QHD Gaming Monitor
Samsung Odyssey G9 QD-OLED 49 Dual QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
PHP Fixes and Dutch Guidance
The Dutch government said the outages were precautionary and reported no signs of active exploitation when it announced them. It also said many government websites, including Rijksoverheid.nl, did not use PHP and were not affected by these particular flaws. The Dutch National Cyber Security Centre later confirmed patches were available and advised organizations to update; its guidance says systems that remain unpatched should stay offline as a precaution.
Cloudflare separately reported seeing attack traffic and attempts to alter payloads to bypass its protections. That is evidence of attempted exploitation observed by the provider, not proof that the named Dutch websites were compromised. Research by Wiz also demonstrated possible impacts against deployments of WordPress, Drupal and Joomla, illustrating that the flaw is in PHP rather than in those applications themselves.
Security researchers also linked the disclosure to AI-assisted vulnerability research. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative; Wiz separately reported discovering and disclosing both vulnerabilities. PHP maintainers led the fixes. Calif’s account says its work used generally available models and depended on a researcher directing the investigation with knowledge of PHP’s vulnerability history.
“The websites were taken offline as a precaution.”
— Dutch government announcement
Exposure and Service Status Remain Unclear
The available announcements do not establish whether every affected Dutch service has since returned online, which specific PHP configurations were involved, or how long each site was unavailable. The government’s statement that it had no signs of active exploitation reflects its assessment at that time; it is not proof that no attempt occurred.
It is also unclear from the supplied reports whether any other organizations experienced successful exploitation. Cloudflare’s observations indicate attack attempts, while the research demonstrations show possible outcomes under particular conditions. Neither confirms that an attacker compromised the listed government services. Exposure can vary with the PHP version, configuration and request-processing setup.
Patch Verification and Return to Service
Operators should apply the fixed PHP release or their distribution’s verified backport, then check that the patched runtime is actually serving each website. For managed hosting customers, that means confirming the provider has updated the PHP environment, rather than relying on an application or plugin update. The Dutch cybersecurity centre’s stated advice is to keep systems offline if they have not been patched.
The next public indicators will be service operators’ confirmation that their sites are patched and back online, along with any revised security guidance or disclosure of confirmed impacts. The source material does not provide a timeline for all services’ restoration or report confirmed compromise of the Dutch sites.
Key Questions
What is PHP2Shell?
PHP2Shell is the name used for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they can allow unauthenticated remote code execution.
Were the Dutch government websites hacked?
The government said it took several sites offline as a precaution and reported no signs of active exploitation at the time. The supplied information does not confirm that Overheid.nl, MijnOverheid.nl or DigiD was compromised.
Which PHP versions include fixes?
PHP listed fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Backports may be available through some vendors for older branches, so organizations should check their distribution or extended-support provider’s advisory.
Will updating WordPress or its plugins fix the issue?
No. The flaws affect the PHP runtime beneath the website application. Updating WordPress or plugins alone does not patch PHP; site owners should verify the runtime update with their host or systems team.
Does observed attack traffic mean the Dutch sites were breached?
No. Cloudflare reported observing attack attempts, but that information does not establish successful exploitation of the named Dutch services. The government’s announcement characterized its shutdowns as precautionary.
Source: ThorstenMeyerAI.com
